agentskeptic 0.1.1

package/dist/assurance/assurancePathArgs.js

@@ -0,0 +1,54 @@
+import path from "node:path";
+/** CLI flags whose following argument is a filesystem path (resolved relative to manifest dir). */
+export const ASSURANCE_PATH_FLAGS = new Set([
+    "--events",
+    "--registry",
+    "--db",
+    "--expect-lock",
+    "--prior",
+    "--current",
+    "--input",
+    "--export-registry",
+    "--emit-events",
+    "--output-lock",
+]);
+/**
+ * Returns a copy of argv with path arguments resolved to absolute paths.
+ * Relative segments are resolved from `manifestDir`.
+ */
+export function resolveSpawnArgvPaths(argv, manifestDir) {
+    const out = [];
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        out.push(a);
+        if (i + 1 >= argv.length)
+            break;
+        if (!ASSURANCE_PATH_FLAGS.has(a))
+            continue;
+        const next = argv[i + 1];
+        if (next.startsWith("-"))
+            continue;
+        if (path.isAbsolute(next)) {
+            i++;
+            out.push(next);
+            continue;
+        }
+        const abs = path.resolve(manifestDir, next);
+        i++;
+        out.push(abs);
+    }
+    return out;
+}
+/** Paths that must exist before spawn (excludes paths that are outputs). */
+export function collectPathArgsForPreflight(argv) {
+    const paths = [];
+    for (let i = 0; i < argv.length - 1; i++) {
+        if (ASSURANCE_PATH_FLAGS.has(argv[i])) {
+            const next = argv[i + 1];
+            if (!next.startsWith("-"))
+                paths.push(next);
+        }
+    }
+    return paths;
+}
+//# sourceMappingURL=assurancePathArgs.js.map

package/dist/assurance/assurancePathArgs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assurancePathArgs.js","sourceRoot":"","sources":["../../src/assurance/assurancePathArgs.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IAC1C,UAAU;IACV,YAAY;IACZ,MAAM;IACN,eAAe;IACf,SAAS;IACT,WAAW;IACX,SAAS;IACT,mBAAmB;IACnB,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAc,EAAE,WAAmB;IACvE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM;QAChC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,CAAC,EAAE,CAAC;YACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC,EAAE,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,2BAA2B,CAAC,IAAc;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/assurance/checkStale.d.ts

@@ -0,0 +1,14 @@
+export type StaleCheckResult = {
+    kind: "fresh";
+} | {
+    kind: "stale";
+} | {
+    kind: "operational";
+    code: string;
+    message: string;
+};
+/**
+ * Exit semantics: fresh → caller exits 0; stale → 1; operational → 3 with envelope.
+ */
+export declare function checkAssuranceReportStale(reportPath: string, maxAgeHours: number): StaleCheckResult;
+//# sourceMappingURL=checkStale.d.ts.map

package/dist/assurance/checkStale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkStale.d.ts","sourceRoot":"","sources":["../../src/assurance/checkStale.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,gBAAgB,CA2ClB"}

package/dist/assurance/checkStale.js

@@ -0,0 +1,48 @@
+import { existsSync, readFileSync } from "node:fs";
+import { loadSchemaValidator } from "../schemaLoad.js";
+/**
+ * Exit semantics: fresh → caller exits 0; stale → 1; operational → 3 with envelope.
+ */
+export function checkAssuranceReportStale(reportPath, maxAgeHours) {
+    if (!existsSync(reportPath)) {
+        return {
+            kind: "operational",
+            code: "ASSURANCE_REPORT_READ_FAILED",
+            message: `Report not found: ${reportPath}`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(reportPath, "utf8"));
+    }
+    catch {
+        return {
+            kind: "operational",
+            code: "ASSURANCE_REPORT_JSON_SYNTAX",
+            message: "Report JSON parse failed.",
+        };
+    }
+    const validate = loadSchemaValidator("assurance-run-report-v1");
+    if (!validate(parsed)) {
+        return {
+            kind: "operational",
+            code: "ASSURANCE_REPORT_SCHEMA_INVALID",
+            message: JSON.stringify(validate.errors ?? []),
+        };
+    }
+    const rep = parsed;
+    const t = Date.parse(rep.issuedAt);
+    if (Number.isNaN(t)) {
+        return {
+            kind: "operational",
+            code: "ASSURANCE_REPORT_SCHEMA_INVALID",
+            message: "issuedAt is not a valid date.",
+        };
+    }
+    const ageMs = Date.now() - t;
+    const maxMs = maxAgeHours * 3600 * 1000;
+    if (ageMs > maxMs)
+        return { kind: "stale" };
+    return { kind: "fresh" };
+}
+//# sourceMappingURL=checkStale.js.map

package/dist/assurance/checkStale.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkStale.js","sourceRoot":"","sources":["../../src/assurance/checkStale.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAOvD;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,qBAAqB,UAAU,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAY,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,2BAA2B;SACrC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAA8B,CAAC;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,+BAA+B;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,WAAW,GAAG,IAAI,GAAG,IAAI,CAAC;IACxC,IAAI,KAAK,GAAG,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/assurance/findRepoRoot.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Walks parents from `startDir` to find the agentskeptic package root
+ * (directory containing package.json with name "agentskeptic").
+ */
+export declare function findWorkflowVerifierRepoRoot(startDir: string): string | null;
+//# sourceMappingURL=findRepoRoot.d.ts.map

package/dist/assurance/findRepoRoot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findRepoRoot.d.ts","sourceRoot":"","sources":["../../src/assurance/findRepoRoot.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB5E"}

package/dist/assurance/findRepoRoot.js

@@ -0,0 +1,27 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+/**
+ * Walks parents from `startDir` to find the agentskeptic package root
+ * (directory containing package.json with name "agentskeptic").
+ */
+export function findWorkflowVerifierRepoRoot(startDir) {
+    let dir = path.resolve(startDir);
+    for (;;) {
+        const pkg = path.join(dir, "package.json");
+        if (existsSync(pkg)) {
+            try {
+                const j = JSON.parse(readFileSync(pkg, "utf8"));
+                if (j.name === "agentskeptic")
+                    return dir;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+//# sourceMappingURL=findRepoRoot.js.map

package/dist/assurance/findRepoRoot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findRepoRoot.js","sourceRoot":"","sources":["../../src/assurance/findRepoRoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAsB,CAAC;gBACrE,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;oBAAE,OAAO,GAAG,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/assurance/runAssurance.d.ts

@@ -0,0 +1,24 @@
+export type AssuranceRunReportV1 = {
+    schemaVersion: 1;
+    issuedAt: string;
+    scenarios: Array<{
+        id: string;
+        exitCode: number;
+    }>;
+};
+export type RunAssuranceResult = {
+    ok: true;
+    report: AssuranceRunReportV1;
+    exitCode: 0 | 1;
+} | {
+    ok: false;
+    exitCode: 3;
+    code: string;
+    message: string;
+};
+/**
+ * Loads manifest, validates schema, runs each scenario by spawning the built CLI from repo root.
+ * Path arguments in each scenario argv are relative to the manifest file's directory.
+ */
+export declare function runAssuranceFromManifest(manifestPath: string): RunAssuranceResult;
+//# sourceMappingURL=runAssurance.d.ts.map

package/dist/assurance/runAssurance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runAssurance.d.ts","sourceRoot":"","sources":["../../src/assurance/runAssurance.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,EAAE,CAAC,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAM9D;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CA4GjF"}

package/dist/assurance/runAssurance.js

@@ -0,0 +1,105 @@
+import { existsSync, readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+import { loadSchemaValidator } from "../schemaLoad.js";
+import { collectPathArgsForPreflight, resolveSpawnArgvPaths, } from "./assurancePathArgs.js";
+import { findWorkflowVerifierRepoRoot } from "./findRepoRoot.js";
+function readManifest(manifestPath) {
+    return JSON.parse(readFileSync(manifestPath, "utf8"));
+}
+/**
+ * Loads manifest, validates schema, runs each scenario by spawning the built CLI from repo root.
+ * Path arguments in each scenario argv are relative to the manifest file's directory.
+ */
+export function runAssuranceFromManifest(manifestPath) {
+    const manifestAbs = path.resolve(manifestPath);
+    if (!existsSync(manifestAbs)) {
+        return {
+            ok: false,
+            exitCode: 3,
+            code: "ASSURANCE_MANIFEST_READ_FAILED",
+            message: `Manifest not found: ${manifestPath}`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = readManifest(manifestAbs);
+    }
+    catch {
+        return {
+            ok: false,
+            exitCode: 3,
+            code: "ASSURANCE_MANIFEST_JSON_SYNTAX",
+            message: "Manifest JSON parse failed.",
+        };
+    }
+    const validateManifest = loadSchemaValidator("assurance-manifest-v1");
+    if (!validateManifest(parsed)) {
+        return {
+            ok: false,
+            exitCode: 3,
+            code: "ASSURANCE_MANIFEST_SCHEMA_INVALID",
+            message: JSON.stringify(validateManifest.errors ?? []),
+        };
+    }
+    const manifest = parsed;
+    const manifestDir = path.dirname(manifestAbs);
+    const repoRoot = findWorkflowVerifierRepoRoot(manifestDir) ?? findWorkflowVerifierRepoRoot(process.cwd());
+    if (repoRoot === null) {
+        return {
+            ok: false,
+            exitCode: 3,
+            code: "ASSURANCE_REPO_ROOT_NOT_FOUND",
+            message: "Could not locate agentskeptic package root from manifest path.",
+        };
+    }
+    const cliJs = path.join(repoRoot, "dist", "cli.js");
+    if (!existsSync(cliJs)) {
+        return {
+            ok: false,
+            exitCode: 3,
+            code: "ASSURANCE_CLI_MISSING",
+            message: `Built CLI not found: ${cliJs}`,
+        };
+    }
+    const scenarioResults = [];
+    for (const sc of manifest.scenarios) {
+        const resolvedArgv = resolveSpawnArgvPaths(sc.argv, manifestDir);
+        const preflightPaths = collectPathArgsForPreflight(resolvedArgv);
+        for (const p of preflightPaths) {
+            if (!existsSync(p)) {
+                return {
+                    ok: false,
+                    exitCode: 3,
+                    code: "ASSURANCE_MANIFEST_PATH_MISSING",
+                    message: `Referenced path missing for scenario ${sc.id}: ${p}`,
+                };
+            }
+        }
+        const r = spawnSync(process.execPath, ["--no-warnings", cliJs, ...resolvedArgv], { encoding: "utf8", cwd: repoRoot });
+        const code = r.status === null ? 3 : r.status;
+        scenarioResults.push({ id: sc.id, exitCode: code });
+    }
+    const issuedAt = new Date().toISOString();
+    const report = {
+        schemaVersion: 1,
+        issuedAt,
+        scenarios: scenarioResults,
+    };
+    const validateReport = loadSchemaValidator("assurance-run-report-v1");
+    if (!validateReport(report)) {
+        return {
+            ok: false,
+            exitCode: 3,
+            code: "INTERNAL_ERROR",
+            message: JSON.stringify(validateReport.errors ?? []),
+        };
+    }
+    const anyFail = scenarioResults.some((s) => s.exitCode !== 0);
+    return {
+        ok: true,
+        report,
+        exitCode: anyFail ? 1 : 0,
+    };
+}
+//# sourceMappingURL=runAssurance.js.map

package/dist/assurance/runAssurance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runAssurance.js","sourceRoot":"","sources":["../../src/assurance/runAssurance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAYjE,SAAS,YAAY,CAAC,YAAoB;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAY,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,uBAAuB,YAAY,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,6BAA6B;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;IACtE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,mCAAmC;YACzC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,IAAI,EAAE,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAGhB,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACZ,4BAA4B,CAAC,WAAW,CAAC,IAAI,4BAA4B,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3F,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,gEAAgE;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,wBAAwB,KAAK,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAA4C,EAAE,CAAC;IAEpE,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjE,MAAM,cAAc,GAAG,2BAA2B,CAAC,YAAY,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,CAAC;oBACX,IAAI,EAAE,iCAAiC;oBACvC,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE;iBAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,CAAC,GAAG,SAAS,CACjB,OAAO,CAAC,QAAQ,EAChB,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,EACzC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CACpC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9C,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAyB;QACnC,aAAa,EAAE,CAAC;QAChB,QAAQ;QACR,SAAS,EAAE,eAAe;KAC3B,CAAC;IAEF,MAAM,cAAc,GAAG,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACtE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,IAAI,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;IAC9D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC1B,CAAC;AACJ,CAAC"}

package/dist/bundleSignatureCodes.d.ts

@@ -0,0 +1,13 @@
+/** Canonical machine codes for bundle signature verification and signing failures. */
+export declare const BUNDLE_SIGNATURE_UNSIGNED_MANIFEST = "BUNDLE_SIGNATURE_UNSIGNED_MANIFEST";
+export declare const BUNDLE_SIGNATURE_MANIFEST_UNSUPPORTED_VERSION = "BUNDLE_SIGNATURE_MANIFEST_UNSUPPORTED_VERSION";
+export declare const BUNDLE_SIGNATURE_MANIFEST_INVALID = "BUNDLE_SIGNATURE_MANIFEST_INVALID";
+export declare const BUNDLE_SIGNATURE_MISSING_ARTIFACT = "BUNDLE_SIGNATURE_MISSING_ARTIFACT";
+export declare const BUNDLE_SIGNATURE_ARTIFACT_INTEGRITY = "BUNDLE_SIGNATURE_ARTIFACT_INTEGRITY";
+export declare const BUNDLE_SIGNATURE_SIDECAR_INVALID = "BUNDLE_SIGNATURE_SIDECAR_INVALID";
+export declare const BUNDLE_SIGNATURE_SIGNED_HASH_MISMATCH = "BUNDLE_SIGNATURE_SIGNED_HASH_MISMATCH";
+export declare const BUNDLE_SIGNATURE_PUBLIC_KEY_MISMATCH = "BUNDLE_SIGNATURE_PUBLIC_KEY_MISMATCH";
+export declare const BUNDLE_SIGNATURE_CRYPTO_INVALID = "BUNDLE_SIGNATURE_CRYPTO_INVALID";
+export declare const BUNDLE_SIGNATURE_PRIVATE_KEY_INVALID = "BUNDLE_SIGNATURE_PRIVATE_KEY_INVALID";
+export type BundleSignatureCode = typeof BUNDLE_SIGNATURE_UNSIGNED_MANIFEST | typeof BUNDLE_SIGNATURE_MANIFEST_UNSUPPORTED_VERSION | typeof BUNDLE_SIGNATURE_MANIFEST_INVALID | typeof BUNDLE_SIGNATURE_MISSING_ARTIFACT | typeof BUNDLE_SIGNATURE_ARTIFACT_INTEGRITY | typeof BUNDLE_SIGNATURE_SIDECAR_INVALID | typeof BUNDLE_SIGNATURE_SIGNED_HASH_MISMATCH | typeof BUNDLE_SIGNATURE_PUBLIC_KEY_MISMATCH | typeof BUNDLE_SIGNATURE_CRYPTO_INVALID | typeof BUNDLE_SIGNATURE_PRIVATE_KEY_INVALID;
+//# sourceMappingURL=bundleSignatureCodes.d.ts.map

package/dist/bundleSignatureCodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundleSignatureCodes.d.ts","sourceRoot":"","sources":["../src/bundleSignatureCodes.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AACvF,eAAO,MAAM,6CAA6C,kDACT,CAAC;AAClD,eAAO,MAAM,iCAAiC,sCAAsC,CAAC;AACrF,eAAO,MAAM,iCAAiC,sCAAsC,CAAC;AACrF,eAAO,MAAM,mCAAmC,wCAAwC,CAAC;AACzF,eAAO,MAAM,gCAAgC,qCAAqC,CAAC;AACnF,eAAO,MAAM,qCAAqC,0CAA0C,CAAC;AAC7F,eAAO,MAAM,oCAAoC,yCAAyC,CAAC;AAC3F,eAAO,MAAM,+BAA+B,oCAAoC,CAAC;AACjF,eAAO,MAAM,oCAAoC,yCAAyC,CAAC;AAE3F,MAAM,MAAM,mBAAmB,GAC3B,OAAO,kCAAkC,GACzC,OAAO,6CAA6C,GACpD,OAAO,iCAAiC,GACxC,OAAO,iCAAiC,GACxC,OAAO,mCAAmC,GAC1C,OAAO,gCAAgC,GACvC,OAAO,qCAAqC,GAC5C,OAAO,oCAAoC,GAC3C,OAAO,+BAA+B,GACtC,OAAO,oCAAoC,CAAC"}

package/dist/bundleSignatureCodes.js

@@ -0,0 +1,12 @@
+/** Canonical machine codes for bundle signature verification and signing failures. */
+export const BUNDLE_SIGNATURE_UNSIGNED_MANIFEST = "BUNDLE_SIGNATURE_UNSIGNED_MANIFEST";
+export const BUNDLE_SIGNATURE_MANIFEST_UNSUPPORTED_VERSION = "BUNDLE_SIGNATURE_MANIFEST_UNSUPPORTED_VERSION";
+export const BUNDLE_SIGNATURE_MANIFEST_INVALID = "BUNDLE_SIGNATURE_MANIFEST_INVALID";
+export const BUNDLE_SIGNATURE_MISSING_ARTIFACT = "BUNDLE_SIGNATURE_MISSING_ARTIFACT";
+export const BUNDLE_SIGNATURE_ARTIFACT_INTEGRITY = "BUNDLE_SIGNATURE_ARTIFACT_INTEGRITY";
+export const BUNDLE_SIGNATURE_SIDECAR_INVALID = "BUNDLE_SIGNATURE_SIDECAR_INVALID";
+export const BUNDLE_SIGNATURE_SIGNED_HASH_MISMATCH = "BUNDLE_SIGNATURE_SIGNED_HASH_MISMATCH";
+export const BUNDLE_SIGNATURE_PUBLIC_KEY_MISMATCH = "BUNDLE_SIGNATURE_PUBLIC_KEY_MISMATCH";
+export const BUNDLE_SIGNATURE_CRYPTO_INVALID = "BUNDLE_SIGNATURE_CRYPTO_INVALID";
+export const BUNDLE_SIGNATURE_PRIVATE_KEY_INVALID = "BUNDLE_SIGNATURE_PRIVATE_KEY_INVALID";
+//# sourceMappingURL=bundleSignatureCodes.js.map

package/dist/bundleSignatureCodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundleSignatureCodes.js","sourceRoot":"","sources":["../src/bundleSignatureCodes.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,MAAM,CAAC,MAAM,kCAAkC,GAAG,oCAAoC,CAAC;AACvF,MAAM,CAAC,MAAM,6CAA6C,GACxD,+CAA+C,CAAC;AAClD,MAAM,CAAC,MAAM,iCAAiC,GAAG,mCAAmC,CAAC;AACrF,MAAM,CAAC,MAAM,iCAAiC,GAAG,mCAAmC,CAAC;AACrF,MAAM,CAAC,MAAM,mCAAmC,GAAG,qCAAqC,CAAC;AACzF,MAAM,CAAC,MAAM,gCAAgC,GAAG,kCAAkC,CAAC;AACnF,MAAM,CAAC,MAAM,qCAAqC,GAAG,uCAAuC,CAAC;AAC7F,MAAM,CAAC,MAAM,oCAAoC,GAAG,sCAAsC,CAAC;AAC3F,MAAM,CAAC,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AACjF,MAAM,CAAC,MAAM,oCAAoC,GAAG,sCAAsC,CAAC"}

package/dist/canonicalParams.d.ts

@@ -0,0 +1,3 @@
+/** Deterministic canonical form for params equality (divergence contract) and observed execution digest. */
+export declare function canonicalJsonForParams(value: unknown): string;
+//# sourceMappingURL=canonicalParams.d.ts.map

package/dist/canonicalParams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalParams.d.ts","sourceRoot":"","sources":["../src/canonicalParams.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAa7D"}

package/dist/canonicalParams.js

@@ -0,0 +1,16 @@
+/** Deterministic canonical form for params equality (divergence contract) and observed execution digest. */
+export function canonicalJsonForParams(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((el) => canonicalJsonForParams(el)).join(",")}]`;
+    }
+    if (typeof value === "object") {
+        const keys = Object.keys(value).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+        const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalJsonForParams(value[k])}`);
+        return `{${parts.join(",")}}`;
+    }
+    return `__non_json_params:${typeof value}__`;
+}
+//# sourceMappingURL=canonicalParams.js.map

package/dist/canonicalParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalParams.js","sourceRoot":"","sources":["../src/canonicalParams.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3G,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,CAAC;IACD,OAAO,qBAAqB,OAAO,KAAK,IAAI,CAAC;AAC/C,CAAC"}

package/dist/ciLock.d.ts

@@ -0,0 +1,52 @@
+import type { WorkflowResult } from "./types.js";
+import type { QuickVerifyReport } from "./quickVerify/runQuickVerify.js";
+export { stableStringify } from "./jsonStableStringify.js";
+export type CiLockBatchV1 = {
+    lockSchemaVersion: 1;
+    kind: "batch";
+    workflowId: string;
+    status: WorkflowResult["status"];
+    verificationPolicy: WorkflowResult["verificationPolicy"];
+    runLevelReasonCodes: string[];
+    eventSequence: {
+        kind: "normal";
+    } | {
+        kind: "irregular";
+        reasonCodes: string[];
+    };
+    steps: Array<{
+        seq: number;
+        toolId: string;
+        status: string;
+        outcomeLabel: string;
+        reasonCodes: string[];
+        referenceCode: string | null;
+    }>;
+    primaryFailureCodes: string[];
+    correctnessEnforcementKind: string | null;
+    enforceableProjection: Record<string, unknown> | null;
+};
+export type CiLockQuickV1 = {
+    lockSchemaVersion: 1;
+    kind: "quick";
+    verdict: QuickVerifyReport["verdict"];
+    ingestReasonCodes: string[];
+    runHeaderReasonCodes: string[];
+    units: Array<{
+        unitId: string;
+        kind: "row" | "related_exists";
+        verdict: "verified" | "fail" | "uncertain";
+        reasonCodes: string[];
+        toolName: string;
+        actionIndex: number;
+    }>;
+};
+export type CiLockV1 = CiLockBatchV1 | CiLockQuickV1;
+export declare function workflowResultToCiLockV1(result: WorkflowResult): CiLockBatchV1;
+export declare function quickReportToCiLockV1(report: QuickVerifyReport): CiLockQuickV1;
+export declare function toCiLockV1(emitted: WorkflowResult): CiLockBatchV1;
+export declare function toCiLockV1(emitted: QuickVerifyReport): CiLockQuickV1;
+export declare function assertCiLockSchemaValid(lock: unknown): asserts lock is CiLockV1;
+export declare function parseCiLockFromUtf8File(path: string): CiLockV1;
+export declare function ciLocksEqualStable(a: CiLockV1, b: CiLockV1): boolean;
+//# sourceMappingURL=ciLock.d.ts.map

package/dist/ciLock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciLock.d.ts","sourceRoot":"","sources":["../src/ciLock.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGzE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAG3D,MAAM,MAAM,aAAa,GAAG;IAC1B,iBAAiB,EAAE,CAAC,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,kBAAkB,EAAE,cAAc,CAAC,oBAAoB,CAAC,CAAC;IACzD,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,aAAa,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjF,KAAK,EAAE,KAAK,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC,CAAC;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,iBAAiB,EAAE,CAAC,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACtC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,KAAK,EAAE,KAAK,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,KAAK,GAAG,gBAAgB,CAAC;QAC/B,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,WAAW,CAAC;QAC3C,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,aAAa,CAAC;AAMrD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa,CA+C9E;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,GAAG,aAAa,CAqB9E;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,CAAC;AACnE,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,CAAC;AAWtE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAQ/E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAiB9D;AAOD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,CAEpE"}

package/dist/ciLock.js

@@ -0,0 +1,117 @@
+import { readFileSync } from "fs";
+import { compareUtf16Id } from "./resolveExpectation.js";
+import { loadSchemaValidator } from "./schemaLoad.js";
+import { TruthLayerError } from "./truthLayerError.js";
+import { stableStringify } from "./jsonStableStringify.js";
+export { stableStringify } from "./jsonStableStringify.js";
+import { CLI_OPERATIONAL_CODES } from "./cliOperationalCodes.js";
+function sortedUniqueStrings(arr) {
+    return [...new Set(arr)].sort((a, b) => a.localeCompare(b));
+}
+export function workflowResultToCiLockV1(result) {
+    const runLevelReasonCodes = sortedUniqueStrings(result.runLevelReasons.map((r) => r.code));
+    const es = result.eventSequenceIntegrity;
+    const eventSequence = es.kind === "normal"
+        ? { kind: "normal" }
+        : { kind: "irregular", reasonCodes: sortedUniqueStrings(es.reasons.map((r) => r.code)) };
+    const truthSteps = result.workflowTruthReport.steps;
+    const stepsLock = result.steps.map((s) => {
+        const ts = truthSteps.find((t) => t.seq === s.seq && t.toolId === s.toolId) ??
+            truthSteps.find((t) => t.seq === s.seq);
+        const outcomeLabel = ts?.outcomeLabel ?? "VERIFIED";
+        return {
+            seq: s.seq,
+            toolId: s.toolId,
+            status: s.status,
+            outcomeLabel,
+            reasonCodes: sortedUniqueStrings(s.reasons.map((r) => r.code)),
+            referenceCode: s.reasons[0]?.code ?? null,
+        };
+    });
+    const fa = result.workflowTruthReport.failureAnalysis;
+    const primaryFailureCodes = fa
+        ? sortedUniqueStrings([...fa.evidence.flatMap((e) => e.codes ?? []), ...fa.unknownReasonCodes])
+        : [];
+    const cd = result.workflowTruthReport.correctnessDefinition;
+    const enforceableProjection = cd?.enforceableProjection;
+    return {
+        lockSchemaVersion: 1,
+        kind: "batch",
+        workflowId: result.workflowId,
+        status: result.status,
+        verificationPolicy: result.verificationPolicy,
+        runLevelReasonCodes,
+        eventSequence,
+        steps: stepsLock,
+        primaryFailureCodes,
+        correctnessEnforcementKind: cd?.enforcementKind ?? null,
+        enforceableProjection: enforceableProjection !== undefined && enforceableProjection !== null
+            ? JSON.parse(JSON.stringify(enforceableProjection))
+            : null,
+    };
+}
+export function quickReportToCiLockV1(report) {
+    const units = [...report.units]
+        .sort((a, b) => compareUtf16Id(a.unitId, b.unitId))
+        .map((u) => ({
+        unitId: u.unitId,
+        kind: u.kind,
+        verdict: u.verdict,
+        reasonCodes: sortedUniqueStrings(u.reasonCodes),
+        toolName: u.sourceAction.toolName,
+        actionIndex: u.sourceAction.actionIndex,
+    }));
+    return {
+        lockSchemaVersion: 1,
+        kind: "quick",
+        verdict: report.verdict,
+        ingestReasonCodes: sortedUniqueStrings(report.ingest.reasonCodes),
+        runHeaderReasonCodes: report.runHeaderReasonCodes
+            ? sortedUniqueStrings(report.runHeaderReasonCodes)
+            : [],
+        units,
+    };
+}
+export function toCiLockV1(emitted) {
+    if ("workflowTruthReport" in emitted && emitted.schemaVersion === 15) {
+        return workflowResultToCiLockV1(emitted);
+    }
+    if ("verdict" in emitted && emitted.schemaVersion === 4) {
+        return quickReportToCiLockV1(emitted);
+    }
+    throw new Error("toCiLockV1: unsupported emitted type");
+}
+export function assertCiLockSchemaValid(lock) {
+    const v = loadSchemaValidator("ci-lock-v1");
+    if (!v(lock)) {
+        throw new TruthLayerError(CLI_OPERATIONAL_CODES.CI_LOCK_SCHEMA_INVALID, JSON.stringify(v.errors ?? []));
+    }
+}
+export function parseCiLockFromUtf8File(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new TruthLayerError(CLI_OPERATIONAL_CODES.CI_LOCK_SCHEMA_INVALID, formatOperationalMessageForLock(msg));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new TruthLayerError(CLI_OPERATIONAL_CODES.CI_LOCK_SCHEMA_INVALID, formatOperationalMessageForLock(msg));
+    }
+    assertCiLockSchemaValid(parsed);
+    return parsed;
+}
+function formatOperationalMessageForLock(msg) {
+    const m = msg.trim();
+    return m.length <= 2000 ? m : `${m.slice(0, 1997)}...`;
+}
+export function ciLocksEqualStable(a, b) {
+    return stableStringify(a) === stableStringify(b);
+}
+//# sourceMappingURL=ciLock.js.map

package/dist/ciLock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciLock.js","sourceRoot":"","sources":["../src/ciLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAyCjE,SAAS,mBAAmB,CAAC,GAAa;IACxC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,MAAM,EAAE,GAAG,MAAM,CAAC,sBAAsB,CAAC;IACzC,MAAM,aAAa,GACjB,EAAE,CAAC,IAAI,KAAK,QAAQ;QAClB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE;QACpB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,mBAAmB,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IAE7F,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,MAAM,EAAE,GACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;YAChE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,EAAE,EAAE,YAAY,IAAI,UAAU,CAAC;QACpD,OAAO;YACL,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY;YACZ,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC;IACtD,MAAM,mBAAmB,GAAG,EAAE;QAC5B,CAAC,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC/F,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,CAAC;IAC5D,MAAM,qBAAqB,GAAG,EAAE,EAAE,qBAAqB,CAAC;IACxD,OAAO;QACL,iBAAiB,EAAE,CAAC;QACpB,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,mBAAmB;QACnB,aAAa;QACb,KAAK,EAAE,SAAS;QAChB,mBAAmB;QACnB,0BAA0B,EAAE,EAAE,EAAE,eAAe,IAAI,IAAI;QACvD,qBAAqB,EACnB,qBAAqB,KAAK,SAAS,IAAI,qBAAqB,KAAK,IAAI;YACnE,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAA6B;YAChF,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAyB;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/C,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ;QACjC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW;KACxC,CAAC,CAAC,CAAC;IACN,OAAO;QACL,iBAAiB,EAAE,CAAC;QACpB,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACjE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YAC/C,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,oBAAoB,CAAC;YAClD,CAAC,CAAC,EAAE;QACN,KAAK;KACN,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,UAAU,CAAC,OAA2C;IACpE,IAAI,qBAAqB,IAAI,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,qBAAqB,CAAC,OAA4B,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAa;IACnD,MAAM,CAAC,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,qBAAqB,CAAC,sBAAsB,EAC5C,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAC/B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,+BAA+B,CAAC,GAAW;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,OAAO,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,CAAW,EAAE,CAAW;IACzD,OAAO,eAAe,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/ciLockWorkflow.d.ts

@@ -0,0 +1,4 @@
+export declare function stripLockFlagsFromArgs(args: string[]): string[];
+export declare function runBatchCiLockFromRestArgs(restArgs: string[]): Promise<void>;
+export declare function runQuickCiLockFromRestArgs(restArgs: string[]): Promise<void>;
+//# sourceMappingURL=ciLockWorkflow.d.ts.map

package/dist/ciLockWorkflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciLockWorkflow.d.ts","sourceRoot":"","sources":["../src/ciLockWorkflow.ts"],"names":[],"mappings":"AAkCA,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE/D;AAED,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0HlF;AAED,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0JlF"}