@yourtechbudstudio/isagi-workflow-verifier 0.0.1

package/LICENSE

@@ -0,0 +1,7 @@
+ISC License
+
+Copyright (c) 2026 YourTechBud
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# Isagi workflow verifier
+
+Verify an already-built Isagi workflow package and write its build receipt:
+
+```sh
+isagi-workflow-verify --workflow .
+```
+
+The verifier has one job: raise the probability that the Isagi runtime loads the workflow build without errors. It checks ahead of time exactly what the runtime checks at load time — exact SDK and verifier pins, symlink-free sources, and a `dist/index.js` bundle that default-exports a loadable workflow definition with a valid `command()` manifest (validated in a bounded child process). When every gate passes it fingerprints the sources and the artifact into `dist/isagi-workflow-build.json`; the runtime re-checks that receipt and refuses to run a workflow whose source or artifact no longer matches it. How the package installs dependencies is deliberately outside this contract.
+
+The workflow package owns compilation and quality. Run the canonical `build` script before verification, and run your own `typecheck` and `test` scripts before that: the verifier never compiles, installs dependencies, or runs package scripts, and it does not gate on tests. The current versions are `@yourtechbudstudio/isagi-workflow-sdk@0.0.1`, `@yourtechbudstudio/isagi-workflow-verifier@0.0.1`, and `esbuild@0.28.0`. For the full authoring guide, use Isagi's installed `isagi-docs` skill.
+
+## Trust boundary
+
+A verified artifact is self-contained with respect to its statically discoverable package import graph. Workflows remain trusted Node.js code and may intentionally access runtime files, processes, network resources, and Node built-ins. Verification is lifecycle containment, not a sandbox.
+
+The `./receipt` export contains pure manifest parsing, canonical serialization, path policy, compatibility constants, and hash primitives for consumers that need to check a receipt without executing verifier operations.

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { runCli } from './cli.js';
+runCli().catch((error) => {
+    process.stderr.write(`Workflow verification failed: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC5F,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+export interface ProcessSpec {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly timeoutMs?: number;
+}
+export interface ProcessResult {
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export type ProcessRunner = (spec: ProcessSpec) => Promise<ProcessResult>;
+export declare function runProcess(spec: ProcessSpec): Promise<ProcessResult>;
+/**
+ * The verifier front-runs the runtime loader: every gate here mirrors a check the Isagi runtime
+ * performs before importing a workflow, so failures surface at authoring time instead of load
+ * time. Quality gates (typecheck, tests) are deliberately absent — they are the author's
+ * responsibility and do not affect whether the runtime can load the artifact.
+ */
+export declare function verifyWorkflow(workflowArgument: string, runner?: ProcessRunner): Promise<void>;
+export declare function runCli(args?: string[]): Promise<void>;

package/dist/cli.js

@@ -0,0 +1,307 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { lstat, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { hashArtifact, hashWorkflowInputs, isWorkflowSourcePath, serializeWorkflowBuildManifest, supportedWorkflowContractVersion, workflowBuildManifestVersion, workflowSdkPackage, workflowSdkVersion, workflowVerifierPackage, workflowVerifierVersion, } from './receipt.js';
+const outputLimit = 128 * 1024;
+const subprocessTimeoutMs = 120_000;
+class VerificationError extends Error {
+}
+export async function runProcess(spec) {
+    return new Promise((resolveResult, reject) => {
+        const child = spawn(spec.command, spec.args, {
+            cwd: spec.cwd,
+            env: spec.env ?? process.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: process.platform !== 'win32',
+            windowsHide: true,
+        });
+        let stdout = Buffer.alloc(0);
+        let stderr = Buffer.alloc(0);
+        let overflow = false;
+        let timedOut = false;
+        const append = (current, chunk) => {
+            const next = Buffer.concat([current, chunk]);
+            if (next.length > outputLimit) {
+                overflow = true;
+                return next.subarray(0, outputLimit);
+            }
+            return next;
+        };
+        child.stdout.on('data', (chunk) => {
+            stdout = append(stdout, chunk);
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr = append(stderr, chunk);
+        });
+        const timer = setTimeout(() => {
+            timedOut = true;
+            terminateTree(child.pid);
+        }, spec.timeoutMs ?? subprocessTimeoutMs);
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            reject(new VerificationError(`Could not start ${spec.command}: ${error.message}`));
+        });
+        child.on('close', (code, signal) => {
+            clearTimeout(timer);
+            const output = [stderr.toString('utf8'), stdout.toString('utf8')].filter(Boolean).join('\n');
+            if (timedOut)
+                return reject(new VerificationError(`${spec.command} timed out after ${spec.timeoutMs ?? subprocessTimeoutMs}ms.\n${output}`));
+            if (overflow)
+                return reject(new VerificationError(`${spec.command} produced more than ${outputLimit} bytes of output, which the verifier refuses to process.`));
+            if (signal)
+                return reject(new VerificationError(`${spec.command} terminated by signal ${signal}.\n${output}`));
+            if (code !== 0)
+                return reject(new VerificationError(`${spec.command} exited with code ${code}.\n${output}`));
+            resolveResult({ stdout: stdout.toString('utf8'), stderr: stderr.toString('utf8') });
+        });
+    });
+}
+function terminateTree(pid) {
+    if (!pid)
+        return;
+    try {
+        if (process.platform === 'win32')
+            spawn('taskkill', ['/pid', String(pid), '/t', '/f'], { stdio: 'ignore', windowsHide: true });
+        else
+            process.kill(-pid, 'SIGTERM');
+    }
+    catch {
+        /* already gone */
+    }
+    setTimeout(() => {
+        try {
+            if (process.platform !== 'win32')
+                process.kill(-pid, 'SIGKILL');
+        }
+        catch {
+            /* already gone */
+        }
+    }, 1_000).unref();
+}
+/**
+ * The verifier front-runs the runtime loader: every gate here mirrors a check the Isagi runtime
+ * performs before importing a workflow, so failures surface at authoring time instead of load
+ * time. Quality gates (typecheck, tests) are deliberately absent — they are the author's
+ * responsibility and do not affect whether the runtime can load the artifact.
+ */
+export async function verifyWorkflow(workflowArgument, runner = runProcess) {
+    const root = resolve(workflowArgument);
+    const packageJson = await readPackageJson(root);
+    requirePins(packageJson);
+    const sourceHash = hashWorkflowInputs(await readSourceInputs(root));
+    const artifactPath = join(root, 'dist', 'index.js');
+    const artifactBytes = await readArtifact(artifactPath);
+    await validateArtifact(root, artifactPath, runner);
+    const manifest = {
+        manifestVersion: workflowBuildManifestVersion,
+        workflowContractVersion: supportedWorkflowContractVersion,
+        sdk: { name: workflowSdkPackage, version: workflowSdkVersion },
+        verifier: { name: workflowVerifierPackage, version: workflowVerifierVersion },
+        source: { sha256: sourceHash },
+        artifact: { entry: 'dist/index.js', sha256: hashArtifact(artifactBytes) },
+    };
+    await writeReceipt(root, manifest);
+}
+async function readPackageJson(root) {
+    const path = join(root, 'package.json');
+    let text;
+    try {
+        text = await readFile(path, 'utf8');
+    }
+    catch (cause) {
+        throw new VerificationError(`Could not read ${path}. Pass the workflow package root (the directory containing package.json) to --workflow. (${message(cause)})`);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (cause) {
+        throw new VerificationError(`package.json contains invalid JSON: ${message(cause)}`);
+    }
+}
+function requirePins(packageJson) {
+    const sdkPin = packageJson.dependencies?.[workflowSdkPackage];
+    if (sdkPin !== workflowSdkVersion)
+        throw new VerificationError(`dependencies["${workflowSdkPackage}"] must be exactly "${workflowSdkVersion}"; found ${found(sdkPin)}. The Isagi runtime refuses to load a workflow whose pin differs from its build receipt.`);
+    const verifierPin = packageJson.devDependencies?.[workflowVerifierPackage];
+    if (verifierPin !== workflowVerifierVersion)
+        throw new VerificationError(`devDependencies["${workflowVerifierPackage}"] must be exactly "${workflowVerifierVersion}"; found ${found(verifierPin)}. The Isagi runtime refuses to load a workflow whose pin differs from its build receipt.`);
+}
+function found(value) {
+    return value === undefined ? 'nothing' : JSON.stringify(value);
+}
+async function readSourceInputs(root) {
+    const paths = ['package.json'];
+    if (await exists(join(root, 'tsconfig.json')))
+        paths.push('tsconfig.json');
+    await walk(root, 'src', paths, { required: true });
+    await walk(root, 'tests', paths, { required: false });
+    const inputs = [];
+    for (const path of paths) {
+        if (!isWorkflowSourcePath(path))
+            continue;
+        const absolute = join(root, ...path.split('/'));
+        const info = await lstat(absolute);
+        if (info.isSymbolicLink())
+            throw new VerificationError(symlinkMessage(path));
+        if (!info.isFile())
+            throw new VerificationError(`${path} must be a regular file so it can be fingerprinted into the build receipt.`);
+        inputs.push({ path, bytes: await readFile(absolute) });
+    }
+    return inputs;
+}
+function symlinkMessage(path) {
+    return `Symlinks are unsupported in workflow packages: ${path}. The Isagi runtime refuses symlinked sources; replace it with a regular file or directory.`;
+}
+async function walk(root, directory, output, options) {
+    const absolute = join(root, directory);
+    let info;
+    try {
+        info = await lstat(absolute);
+    }
+    catch (cause) {
+        if (cause.code !== 'ENOENT')
+            throw new VerificationError(`Could not read ${directory}/: ${message(cause)}`);
+        if (!options.required)
+            return;
+        throw new VerificationError(`A ${directory}/ directory is required: the workflow sources live there and are fingerprinted into the build receipt. Check that --workflow points at the workflow package root.`);
+    }
+    if (info.isSymbolicLink())
+        throw new VerificationError(symlinkMessage(directory));
+    if (!info.isDirectory())
+        throw new VerificationError(`${directory} must be a directory, not a file.`);
+    for (const entry of await readdir(absolute, { withFileTypes: true })) {
+        const path = `${directory}/${entry.name}`;
+        if (entry.isSymbolicLink())
+            throw new VerificationError(symlinkMessage(path));
+        if (entry.isDirectory())
+            await walk(root, path, output, { required: true });
+        else if (entry.isFile())
+            output.push(path);
+        else
+            throw new VerificationError(`Unsupported filesystem entry (not a regular file or directory): ${path}. Remove it; only regular files can be fingerprinted into the build receipt.`);
+    }
+}
+async function readArtifact(path) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (cause) {
+        throw new VerificationError("Workflow build output dist/index.js is missing. Run the package's build script before verification; the verifier never compiles on the author's behalf.", { cause });
+    }
+    if (info.isSymbolicLink() || !info.isFile())
+        throw new VerificationError("dist/index.js must be a regular file, not a symlink or directory. Re-run the package's build script to regenerate it.");
+    return readFile(path);
+}
+/**
+ * Imports the built artifact in an isolated child process the way the runtime loader will, and
+ * checks the exported workflow definition and its command() manifest. The child reports through a
+ * result file rather than stdout, so workflow code that logs during import or command() cannot
+ * corrupt the report.
+ */
+async function validateArtifact(root, artifact, runner) {
+    const isolatedRoot = await mkdtemp(join(tmpdir(), 'isagi-workflow-validation-'));
+    try {
+        const isolatedArtifact = join(isolatedRoot, 'index.mjs');
+        await writeFile(isolatedArtifact, await readFile(artifact));
+        const resultPath = join(isolatedRoot, 'result.json');
+        const validatorPath = join(isolatedRoot, 'validate.mjs');
+        await writeFile(validatorPath, validatorSource(isolatedArtifact, resultPath, root));
+        try {
+            await runner({
+                command: process.execPath,
+                args: [validatorPath],
+                cwd: isolatedRoot,
+                timeoutMs: 10_000,
+            });
+        }
+        catch (cause) {
+            throw new VerificationError(`dist/index.js failed the artifact check: the bundle crashed the validation process instead of completing. Module-level code in the bundle must settle without crashing, exiting, or hanging.\n${message(cause)}`);
+        }
+        let report;
+        try {
+            report = JSON.parse(await readFile(resultPath, 'utf8'));
+        }
+        catch {
+            throw new VerificationError('dist/index.js failed the artifact check: the bundle terminated the validation process (for example via process.exit) before the check finished. Workflow code must not exit the process.');
+        }
+        if (!report || typeof report !== 'object' || report.ok !== true)
+            throw new VerificationError(`dist/index.js failed the artifact check that mirrors how the Isagi runtime loads workflows:\n${String(report?.error ?? 'The validation report is malformed.')}\nFix the workflow source, rebuild, and re-run verification.`);
+    }
+    finally {
+        await rm(isolatedRoot, { recursive: true, force: true });
+    }
+}
+function validatorSource(artifactPath, resultPath, worktreePath) {
+    return [
+        `import { writeFileSync } from 'node:fs';`,
+        `const finish = (report) => { writeFileSync(${JSON.stringify(resultPath)}, JSON.stringify(report)); process.exit(0); };`,
+        `const describe = (value) => (Array.isArray(value) ? 'an array' : value === null ? 'null' : typeof value);`,
+        `const cause = (error) => String((error && error.stack) || error);`,
+        `let artifact;`,
+        `try { artifact = await import(${JSON.stringify(pathToFileURL(artifactPath).href)}); }`,
+        `catch (error) { finish({ ok: false, error: 'Importing the bundle threw before any workflow definition could be read:\\n' + cause(error) }); }`,
+        `const workflow = artifact.default;`,
+        `if (!workflow || typeof workflow !== 'object') finish({ ok: false, error: 'The bundle must default-export the workflow definition object returned by defineWorkflow(); its default export is ' + describe(workflow) + '.' });`,
+        `const missing = ['command', 'validate', 'init', 'step'].filter((name) => typeof workflow[name] !== 'function');`,
+        `if (missing.length) finish({ ok: false, error: 'The default-exported workflow definition is missing required function(s): ' + missing.join(', ') + '. Default-export the object returned by defineWorkflow() from src/index.ts.' });`,
+        `let manifest;`,
+        `try { manifest = await workflow.command({ worktreeId: 0, worktreePath: ${JSON.stringify(worktreePath)}, surfaceId: 0, paneId: null, agentSessionId: null }); }`,
+        `catch (error) { finish({ ok: false, error: 'command() threw when called with a minimal launch context. command() must succeed without optional pane or agent-session context.\\n' + cause(error) }); }`,
+        `const problems = [];`,
+        `if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) problems.push('command() must return a manifest object; it returned ' + describe(manifest) + '.');`,
+        `else {`,
+        `  if (typeof manifest.title !== 'string' || !manifest.title) problems.push('command() must return a manifest with a non-empty string title; found ' + describe(manifest.title) + '.');`,
+        `  if (manifest.description !== undefined && typeof manifest.description !== 'string') problems.push('command() manifest description must be a string when present; found ' + describe(manifest.description) + '.');`,
+        `  if (manifest.inputs !== undefined && !Array.isArray(manifest.inputs)) problems.push('command() manifest inputs must be an array when present; found ' + describe(manifest.inputs) + '.');`,
+        `  for (const [index, input] of (Array.isArray(manifest.inputs) ? manifest.inputs : []).entries()) {`,
+        `    const where = 'inputs[' + index + ']' + (input && typeof input.key === 'string' && input.key ? ' (key "' + input.key + '")' : '');`,
+        `    if (!input || typeof input !== 'object') { problems.push('command() ' + where + ' must be an input object; found ' + describe(input) + '.'); continue; }`,
+        `    if (!['text', 'select', 'multi-select', 'confirm'].includes(input.kind)) problems.push('command() ' + where + ' has kind ' + JSON.stringify(input.kind) + '; expected "text", "select", "multi-select", or "confirm".');`,
+        `    if (typeof input.key !== 'string' || !input.key) problems.push('command() ' + where + ' needs a non-empty string key.');`,
+        `    if (typeof input.label !== 'string' || !input.label) problems.push('command() ' + where + ' needs a non-empty string label.');`,
+        `    if (input.kind === 'select' || input.kind === 'multi-select') {`,
+        `      if (!Array.isArray(input.options)) problems.push('command() ' + where + ' is a ' + input.kind + ' input and needs an options array.');`,
+        `      else for (const [optionIndex, option] of input.options.entries()) if (!option || typeof option.value !== 'string') problems.push('command() ' + where + ' options[' + optionIndex + '] needs a string value.');`,
+        `    }`,
+        `  }`,
+        `}`,
+        `finish(problems.length ? { ok: false, error: problems.join('\\n') } : { ok: true });`,
+        ``,
+    ].join('\n');
+}
+async function writeReceipt(root, manifest) {
+    const receiptPath = join(root, 'dist', 'isagi-workflow-build.json');
+    const temporary = `${receiptPath}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, serializeWorkflowBuildManifest(manifest), { flag: 'wx' });
+        await rename(temporary, receiptPath);
+    }
+    catch (cause) {
+        await rm(temporary, { force: true }).catch(() => undefined);
+        throw new VerificationError(`Could not write the build receipt ${receiptPath}: ${message(cause)}`);
+    }
+}
+async function exists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export async function runCli(args = process.argv.slice(2)) {
+    if (args.length !== 2 || args[0] !== '--workflow' || !args[1])
+        throw new VerificationError('Usage: isagi-workflow-verify --workflow <exact-directory>');
+    await verifyWorkflow(args[1]);
+    process.stdout.write('Workflow verified. Build receipt is ready.\n');
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,8BAA8B,EAC9B,gCAAgC,EAChC,4BAA4B,EAC5B,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC;AAC/B,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAcpC,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAExC,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAiB;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;YAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC5B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;gBAC9B,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,iBAAiB,CAAC,mBAAmB,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7F,IAAI,QAAQ;gBACV,OAAO,MAAM,CACX,IAAI,iBAAiB,CACnB,GAAG,IAAI,CAAC,OAAO,oBAAoB,IAAI,CAAC,SAAS,IAAI,mBAAmB,QAAQ,MAAM,EAAE,CACzF,CACF,CAAC;YACJ,IAAI,QAAQ;gBACV,OAAO,MAAM,CACX,IAAI,iBAAiB,CACnB,GAAG,IAAI,CAAC,OAAO,uBAAuB,WAAW,0DAA0D,CAC5G,CACF,CAAC;YACJ,IAAI,MAAM;gBACR,OAAO,MAAM,CACX,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO,yBAAyB,MAAM,MAAM,MAAM,EAAE,CAAC,CACpF,CAAC;YACJ,IAAI,IAAI,KAAK,CAAC;gBACZ,OAAO,MAAM,CACX,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO,qBAAqB,IAAI,MAAM,MAAM,EAAE,CAAC,CAC9E,CAAC;YACJ,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC9B,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;;YAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,gBAAwB,EACxB,MAAM,GAAkB,UAAU;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,WAAW,CAAC,WAAW,CAAC,CAAC;IACzB,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,QAAQ,GAA0B;QACtC,eAAe,EAAE,4BAA4B;QAC7C,uBAAuB,EAAE,gCAAgC;QACzD,GAAG,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,EAAE;QAC9D,QAAQ,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,uBAAuB,EAAE;QAC7E,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;QAC9B,QAAQ,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE;KAC1E,CAAC;IACF,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,IAAI,4FAA4F,OAAO,CAAC,KAAK,CAAC,GAAG,CACpI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,WAAgC;IACnD,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,kBAAkB;QAC/B,MAAM,IAAI,iBAAiB,CACzB,iBAAiB,kBAAkB,uBAAuB,kBAAkB,YAAY,KAAK,CAAC,MAAM,CAAC,0FAA0F,CAChM,CAAC;IACJ,MAAM,WAAW,GAAG,WAAW,CAAC,eAAe,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAC3E,IAAI,WAAW,KAAK,uBAAuB;QACzC,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,uBAAuB,uBAAuB,uBAAuB,YAAY,KAAK,CAAC,WAAW,CAAC,0FAA0F,CAClN,CAAC;AACN,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/B,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3E,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAChB,MAAM,IAAI,iBAAiB,CACzB,GAAG,IAAI,4EAA4E,CACpF,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,kDAAkD,IAAI,6FAA6F,CAAC;AAC7J,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,SAAiB,EACjB,MAAgB,EAChB,OAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YACpD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,SAAS,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO;QAC9B,MAAM,IAAI,iBAAiB,CACzB,KAAK,SAAS,mKAAmK,CAClL,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QACrB,MAAM,IAAI,iBAAiB,CAAC,GAAG,SAAS,mCAAmC,CAAC,CAAC;IAC/E,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;aACvE,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YAEzC,MAAM,IAAI,iBAAiB,CACzB,mEAAmE,IAAI,8EAA8E,CACtJ,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,yJAAyJ,EACzJ,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QACzC,MAAM,IAAI,iBAAiB,CACzB,uHAAuH,CACxH,CAAC;IACJ,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,QAAgB,EAChB,MAAqB;IAErB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,gBAAgB,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,aAAa,EAAE,eAAe,CAAC,gBAAgB,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC;gBACX,OAAO,EAAE,OAAO,CAAC,QAAQ;gBACzB,IAAI,EAAE,CAAC,aAAa,CAAC;gBACrB,GAAG,EAAE,YAAY;gBACjB,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CACzB,iMAAiM,OAAO,CAAC,KAAK,CAAC,EAAE,CAClN,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CACzB,0LAA0L,CAC3L,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAK,MAA2B,CAAC,EAAE,KAAK,IAAI;YACnF,MAAM,IAAI,iBAAiB,CACzB,gGAAgG,MAAM,CAAE,MAA8B,EAAE,KAAK,IAAI,qCAAqC,CAAC,8DAA8D,CACtP,CAAC;IACN,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,UAAkB,EAAE,YAAoB;IACrF,OAAO;QACL,0CAA0C;QAC1C,8CAA8C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gDAAgD;QACxH,2GAA2G;QAC3G,mEAAmE;QACnE,eAAe;QACf,iCAAiC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM;QACvF,+IAA+I;QAC/I,oCAAoC;QACpC,+NAA+N;QAC/N,iHAAiH;QACjH,sOAAsO;QACtO,eAAe;QACf,0EAA0E,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,0DAA0D;QAChK,wMAAwM;QACxM,sBAAsB;QACtB,8KAA8K;QAC9K,QAAQ;QACR,wLAAwL;QACxL,qNAAqN;QACrN,6LAA6L;QAC7L,qGAAqG;QACrG,wIAAwI;QACxI,8JAA8J;QAC9J,8NAA8N;QAC9N,8HAA8H;QAC9H,oIAAoI;QACpI,qEAAqE;QACrE,8IAA8I;QAC9I,uNAAuN;QACvN,OAAO;QACP,KAAK;QACL,GAAG;QACH,sFAAsF;QACtF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAA+B;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,GAAG,WAAW,IAAI,UAAU,EAAE,MAAM,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,8BAA8B,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,iBAAiB,CACzB,qCAAqC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,iBAAiB,CAAC,2DAA2D,CAAC,CAAC;IAC3F,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;AACvE,CAAC"}

package/dist/receipt.d.ts

@@ -0,0 +1,41 @@
+export declare const workflowBuildManifestVersion: 1;
+export declare const supportedWorkflowContractVersion: 1;
+export declare const workflowSdkPackage: '@yourtechbudstudio/isagi-workflow-sdk';
+export declare const workflowVerifierPackage: '@yourtechbudstudio/isagi-workflow-verifier';
+export declare const workflowSdkVersion: '0.0.1';
+export declare const workflowVerifierVersion: '0.0.1';
+export declare const workflowBuilderPackage: 'esbuild';
+export declare const workflowBuilderVersion: '0.28.0';
+export declare const workflowBuildCommand: 'esbuild src/index.ts --bundle --format=esm --platform=node --target=node22 --log-override:unsupported-dynamic-import=error --outfile=dist/index.js';
+export declare const workflowVerifyCommand: 'isagi-workflow-verify --workflow .';
+export declare const verifierReservedPrefix: '.isagi-workflow-verifier-';
+export interface WorkflowBuildManifest {
+    readonly manifestVersion: typeof workflowBuildManifestVersion;
+    readonly workflowContractVersion: typeof supportedWorkflowContractVersion;
+    readonly sdk: {
+        readonly name: typeof workflowSdkPackage;
+        readonly version: string;
+    };
+    readonly verifier: {
+        readonly name: typeof workflowVerifierPackage;
+        readonly version: string;
+    };
+    readonly source: {
+        readonly sha256: string;
+    };
+    readonly artifact: {
+        readonly entry: 'dist/index.js';
+        readonly sha256: string;
+    };
+}
+export interface HashInput {
+    readonly path: string;
+    readonly bytes: Uint8Array;
+}
+export declare function normalizeWorkflowPath(path: string): string;
+export declare function isWorkflowSourcePath(path: string): boolean;
+export declare function hashWorkflowInputs(inputs: readonly HashInput[]): string;
+export declare function hashArtifact(bytes: Uint8Array): string;
+export declare function serializeWorkflowBuildManifest(manifest: WorkflowBuildManifest): string;
+export declare function parseWorkflowBuildManifest(input: unknown): WorkflowBuildManifest;
+export declare function parseWorkflowBuildManifestJson(json: string): WorkflowBuildManifest;

package/dist/receipt.js

@@ -0,0 +1,127 @@
+import { createHash } from 'node:crypto';
+export const workflowBuildManifestVersion = 1;
+export const supportedWorkflowContractVersion = 1;
+export const workflowSdkPackage = '@yourtechbudstudio/isagi-workflow-sdk';
+export const workflowVerifierPackage = '@yourtechbudstudio/isagi-workflow-verifier';
+export const workflowSdkVersion = '0.0.1';
+export const workflowVerifierVersion = '0.0.1';
+export const workflowBuilderPackage = 'esbuild';
+export const workflowBuilderVersion = '0.28.0';
+export const workflowBuildCommand = 'esbuild src/index.ts --bundle --format=esm --platform=node --target=node22 --log-override:unsupported-dynamic-import=error --outfile=dist/index.js';
+export const workflowVerifyCommand = 'isagi-workflow-verify --workflow .';
+export const verifierReservedPrefix = '.isagi-workflow-verifier-';
+const sha256Pattern = /^[a-f0-9]{64}$/;
+export function normalizeWorkflowPath(path) {
+    const normalized = path.replaceAll('\\', '/').replace(/^\.\//, '');
+    if (!normalized || normalized.startsWith('/') || normalized.split('/').includes('..')) {
+        throw new Error(`Path is outside the workflow package: ${path}`);
+    }
+    return normalized;
+}
+export function isWorkflowSourcePath(path) {
+    const normalized = normalizeWorkflowPath(path);
+    if (normalized.startsWith(verifierReservedPrefix))
+        return false;
+    return (normalized === 'package.json' ||
+        normalized === 'tsconfig.json' ||
+        normalized.startsWith('src/') ||
+        normalized.startsWith('tests/'));
+}
+export function hashWorkflowInputs(inputs) {
+    const normalized = inputs
+        .map((input) => ({ path: normalizeWorkflowPath(input.path), bytes: input.bytes }))
+        .sort((left, right) => left.path.localeCompare(right.path, 'en'));
+    const seen = new Set();
+    const hash = createHash('sha256');
+    for (const input of normalized) {
+        if (seen.has(input.path))
+            throw new Error(`Duplicate workflow hash input: ${input.path}`);
+        seen.add(input.path);
+        const pathBytes = Buffer.from(input.path, 'utf8');
+        const size = Buffer.alloc(16);
+        size.writeBigUInt64BE(BigInt(pathBytes.length), 0);
+        size.writeBigUInt64BE(BigInt(input.bytes.byteLength), 8);
+        hash.update(size).update(pathBytes).update(input.bytes);
+    }
+    return hash.digest('hex');
+}
+export function hashArtifact(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+export function serializeWorkflowBuildManifest(manifest) {
+    parseWorkflowBuildManifest(manifest);
+    return `${JSON.stringify(manifest, null, 2)}\n`;
+}
+export function parseWorkflowBuildManifest(input) {
+    if (!isRecord(input))
+        throw new Error('Build manifest must be an object.');
+    assertExactKeys(input, ['manifestVersion', 'workflowContractVersion', 'sdk', 'verifier', 'source', 'artifact'], 'manifest');
+    if (input.manifestVersion !== workflowBuildManifestVersion)
+        throw new Error(`Unsupported manifestVersion ${JSON.stringify(input.manifestVersion)}; this verifier supports ${workflowBuildManifestVersion}.`);
+    if (input.workflowContractVersion !== supportedWorkflowContractVersion)
+        throw new Error(`Unsupported workflowContractVersion ${JSON.stringify(input.workflowContractVersion)}; this verifier supports ${supportedWorkflowContractVersion}.`);
+    const sdk = packageIdentity(input.sdk, 'sdk', workflowSdkPackage);
+    const verifier = packageIdentity(input.verifier, 'verifier', workflowVerifierPackage);
+    const source = digestObject(input.source, 'source');
+    if (!isRecord(input.artifact))
+        throw new Error('artifact must be an object.');
+    assertExactKeys(input.artifact, ['entry', 'sha256'], 'artifact');
+    if (input.artifact.entry !== 'dist/index.js')
+        throw new Error('artifact.entry must be dist/index.js.');
+    const artifactHash = requiredString(input.artifact.sha256, 'artifact.sha256');
+    if (!sha256Pattern.test(artifactHash))
+        throw new Error('artifact.sha256 must be a lowercase SHA-256 digest.');
+    return {
+        manifestVersion: workflowBuildManifestVersion,
+        workflowContractVersion: supportedWorkflowContractVersion,
+        sdk,
+        verifier,
+        source,
+        artifact: { entry: 'dist/index.js', sha256: artifactHash },
+    };
+}
+export function parseWorkflowBuildManifestJson(json) {
+    try {
+        return parseWorkflowBuildManifest(JSON.parse(json));
+    }
+    catch (error) {
+        throw new Error(`Invalid workflow build manifest: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+}
+function packageIdentity(value, field, expectedName) {
+    if (!isRecord(value))
+        throw new Error(`${field} must be an object.`);
+    assertExactKeys(value, ['name', 'version'], field);
+    if (value.name !== expectedName)
+        throw new Error(`${field}.name must be ${expectedName}.`);
+    return { name: expectedName, version: requiredString(value.version, `${field}.version`) };
+}
+function digestObject(value, field) {
+    if (!isRecord(value))
+        throw new Error(`${field} must be an object.`);
+    assertExactKeys(value, ['sha256'], field);
+    const sha256 = requiredString(value.sha256, `${field}.sha256`);
+    if (!sha256Pattern.test(sha256))
+        throw new Error(`${field}.sha256 must be a lowercase SHA-256 digest.`);
+    return { sha256 };
+}
+function requiredString(value, field) {
+    if (typeof value !== 'string' || !value)
+        throw new Error(`${field} must be a non-empty string.`);
+    return value;
+}
+function assertExactKeys(value, expected, field) {
+    const missing = expected.filter((key) => !Object.hasOwn(value, key));
+    const unexpected = Object.keys(value).filter((key) => !expected.includes(key));
+    if (missing.length === 0 && unexpected.length === 0)
+        return;
+    const parts = [
+        ...(missing.length ? [`missing fields: ${missing.join(', ')}`] : []),
+        ...(unexpected.length ? [`unexpected fields: ${unexpected.join(', ')}`] : []),
+    ];
+    throw new Error(`${field} has ${parts.join('; ')}.`);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=receipt.js.map

package/dist/receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAU,CAAC;AACvD,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,uCAAgD,CAAC;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,4CAAqD,CAAC;AAC7F,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAgB,CAAC;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAkB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAiB,CAAC;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAC/B,oJAA6J,CAAC;AAChK,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAA6C,CAAC;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAAoC,CAAC;AAgB3E,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,CACL,UAAU,KAAK,cAAc;QAC7B,UAAU,KAAK,eAAe;QAC9B,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA4B;IAC7D,MAAM,UAAU,GAAG,MAAM;SACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;SACjF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,QAA+B;IAC5E,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,eAAe,CACb,KAAK,EACL,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,EACvF,UAAU,CACX,CAAC;IACF,IAAI,KAAK,CAAC,eAAe,KAAK,4BAA4B;QACxD,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,4BAA4B,4BAA4B,GAAG,CAChI,CAAC;IACJ,IAAI,KAAK,CAAC,uBAAuB,KAAK,gCAAgC;QACpE,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uBAAuB,CAAC,4BAA4B,gCAAgC,GAAG,CACpJ,CAAC;IACJ,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9E,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,eAAe;QAC1C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,OAAO;QACL,eAAe,EAAE,4BAA4B;QAC7C,uBAAuB,EAAE,gCAAgC;QACzD,GAAG;QACH,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC5F,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,KAAa,EACb,YAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACrE,eAAe,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,YAAY,GAAG,CAAC,CAAC;IAC3F,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,UAAU,CAAC,EAAE,CAAC;AAC5F,CAAC;AACD,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACrE,eAAe,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;IACzE,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,eAAe,CACtB,KAA8B,EAC9B,QAA2B,EAC3B,KAAa;IAEb,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC5D,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,sBAAsB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;IACF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@yourtechbudstudio/isagi-workflow-verifier",
+  "version": "0.0.1",
+  "description": "Verify standalone Isagi workflow artifacts and issue build receipts.",
+  "license": "ISC",
+  "author": "YourTechBud",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/YourTechBudStudio/Isagi.git",
+    "directory": "packages/workflow-verifier"
+  },
+  "bin": {
+    "isagi-workflow-verify": "./dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "types": "./dist/receipt.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/receipt.d.ts",
+      "import": "./dist/receipt.js"
+    },
+    "./receipt": {
+      "types": "./dist/receipt.d.ts",
+      "import": "./dist/receipt.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "@yourtechbudstudio/isagi-workflow-sdk": "0.0.1",
+    "tsx": "^4.21.0",
+    "typescript": "^7.0.2"
+  },
+  "peerDependencies": {
+    "@yourtechbudstudio/isagi-workflow-sdk": "0.0.1"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "check": "pnpm typecheck && pnpm test && pnpm build && pnpm pack --dry-run",
+    "test": "node --import tsx --test \"src/**/*.test.ts\"",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  }
+}