agentskeptic 1.0.4 → 1.2.0

package/dist/stateWitness.js

@@ -0,0 +1,383 @@
+import { createHash } from "node:crypto";
+import { GetObjectCommand, HeadObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { MongoClient } from "mongodb";
+import { getPointer } from "./jsonPointer.js";
+import { verificationScalarsEqual } from "./valueVerification.js";
+import { SQL_VERIFICATION_OUTCOME_CODE } from "./wireReasonCodes.js";
+const S3_DEADLINE_MS = 1900;
+const MAX_S3_BODY_HASH_BYTES = 10 * 1024 * 1024;
+function setupError(msg) {
+    return {
+        status: "incomplete_verification",
+        reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.STATE_WITNESS_SETUP_ERROR, message: msg }],
+        evidenceSummary: {},
+    };
+}
+async function fetchWithDeadline(url, init, deadlineMs) {
+    const ac = new AbortController();
+    const t = setTimeout(() => ac.abort(), deadlineMs);
+    try {
+        return await fetch(url, { ...init, signal: ac.signal });
+    }
+    finally {
+        clearTimeout(t);
+    }
+}
+function isAbsoluteHttpOrHttps(s) {
+    try {
+        const { protocol } = new URL(s);
+        return protocol === "http:" || protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function vectorProviderBaseFromHost(host) {
+    const t = host.trim();
+    if (isAbsoluteHttpOrHttps(t)) {
+        return t;
+    }
+    return `https://${t}`;
+}
+async function reconcileVectorDocument(req) {
+    if (req.expectPayloadSha256) {
+        return setupError("vector_document: expectPayloadSha256 is not supported yet; use metadataEq");
+    }
+    const host = req.host ??
+        (req.provider === "pinecone"
+            ? process.env.PINECONE_INDEX_HOST
+            : req.provider === "weaviate"
+                ? process.env.WEAVIATE_HOST
+                : process.env.CHROMA_HOST);
+    if (!host || host.length === 0) {
+        return setupError(`vector_document (${req.provider}): missing host in registry or env (PINECONE_INDEX_HOST / WEAVIATE_HOST / CHROMA_HOST)`);
+    }
+    const apiKey = req.provider === "pinecone"
+        ? process.env.PINECONE_API_KEY
+        : req.provider === "weaviate"
+            ? process.env.WEAVIATE_API_KEY
+            : process.env.CHROMA_TENANT_AUTH_TOKEN ?? process.env.CHROMA_API_KEY;
+    if (!apiKey) {
+        return setupError(`vector_document (${req.provider}): missing API key env`);
+    }
+    const base = vectorProviderBaseFromHost(host);
+    try {
+        if (req.provider === "pinecone") {
+            const r = await fetchWithDeadline(`${base.replace(/\/$/, "")}/vectors/fetch`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", "Api-Key": apiKey },
+                body: JSON.stringify({
+                    ids: [req.documentId],
+                    ...(req.namespace !== undefined && req.namespace.length > 0 ? { namespace: req.namespace } : {}),
+                }),
+            }, 8000);
+            if (!r.ok) {
+                return {
+                    status: "incomplete_verification",
+                    reasons: [
+                        {
+                            code: SQL_VERIFICATION_OUTCOME_CODE.VECTOR_PROVIDER_ERROR,
+                            message: `Pinecone fetch HTTP ${r.status}`,
+                        },
+                    ],
+                    evidenceSummary: { httpStatus: r.status },
+                };
+            }
+            const body = (await r.json());
+            const vec = body.vectors?.[req.documentId];
+            if (!vec) {
+                return {
+                    status: "missing",
+                    reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.VECTOR_NOT_FOUND, message: "Vector id not found in index" }],
+                    evidenceSummary: { provider: req.provider },
+                };
+            }
+            if (req.metadataSubset) {
+                for (const [k, exp] of Object.entries(req.metadataSubset)) {
+                    const act = vec.metadata?.[k];
+                    const cmp = verificationScalarsEqual(exp, act);
+                    if (!cmp.ok) {
+                        return {
+                            status: "inconsistent",
+                            reasons: [
+                                {
+                                    code: SQL_VERIFICATION_OUTCOME_CODE.VECTOR_METADATA_MISMATCH,
+                                    message: `metadata.${k}: expected ${cmp.expected} found ${cmp.actual}`,
+                                },
+                            ],
+                            evidenceSummary: { field: k },
+                        };
+                    }
+                }
+            }
+            return { status: "verified", reasons: [], evidenceSummary: { provider: req.provider, vector: true } };
+        }
+        if (req.provider === "weaviate") {
+            const cls = encodeURIComponent(req.indexName);
+            const id = encodeURIComponent(req.documentId);
+            const r = await fetchWithDeadline(`${base.replace(/\/$/, "")}/v1/objects/${cls}/${id}`, { headers: { Authorization: `Bearer ${apiKey}` } }, 8000);
+            if (r.status === 404) {
+                return {
+                    status: "missing",
+                    reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.VECTOR_NOT_FOUND, message: "Weaviate object not found" }],
+                    evidenceSummary: {},
+                };
+            }
+            if (!r.ok) {
+                return {
+                    status: "incomplete_verification",
+                    reasons: [
+                        { code: SQL_VERIFICATION_OUTCOME_CODE.VECTOR_PROVIDER_ERROR, message: `Weaviate HTTP ${r.status}` },
+                    ],
+                    evidenceSummary: { httpStatus: r.status },
+                };
+            }
+            return { status: "verified", reasons: [], evidenceSummary: { provider: "weaviate" } };
+        }
+        const coll = encodeURIComponent(req.indexName);
+        const r = await fetchWithDeadline(`${base.replace(/\/$/, "")}/api/v1/collections/${coll}/get`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}) },
+            body: JSON.stringify({ ids: [req.documentId] }),
+        }, 8000);
+        if (!r.ok) {
+            return {
+                status: "incomplete_verification",
+                reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.VECTOR_PROVIDER_ERROR, message: `Chroma HTTP ${r.status}` }],
+                evidenceSummary: { httpStatus: r.status },
+            };
+        }
+        const body = (await r.json());
+        if (!body.ids?.includes(req.documentId)) {
+            return {
+                status: "missing",
+                reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.VECTOR_NOT_FOUND, message: "Chroma id not returned" }],
+                evidenceSummary: {},
+            };
+        }
+        return { status: "verified", reasons: [], evidenceSummary: { provider: "chroma" } };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return {
+            status: "incomplete_verification",
+            reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.VECTOR_PROVIDER_ERROR, message: msg }],
+            evidenceSummary: { error: true },
+        };
+    }
+}
+async function reconcileObjectStorage(req) {
+    const region = process.env.AWS_REGION ?? "us-east-1";
+    const client = new S3Client({
+        region,
+        ...(req.endpoint ? { endpoint: req.endpoint, forcePathStyle: true } : {}),
+    });
+    const started = Date.now();
+    try {
+        const head = await Promise.race([
+            client.send(new HeadObjectCommand({ Bucket: req.bucket, Key: req.key })),
+            new Promise((_, rej) => setTimeout(() => rej(new Error("S3 head timeout")), S3_DEADLINE_MS)),
+        ]);
+        const contentLength = Number(head.ContentLength ?? 0);
+        if (req.expectSizeBytes !== undefined && contentLength !== req.expectSizeBytes) {
+            return {
+                status: "inconsistent",
+                reasons: [
+                    {
+                        code: SQL_VERIFICATION_OUTCOME_CODE.OBJECT_SIZE_MISMATCH,
+                        message: `Expected size ${req.expectSizeBytes} but Content-Length is ${contentLength}`,
+                    },
+                ],
+                evidenceSummary: { contentLength },
+            };
+        }
+        if (req.expectEtag !== undefined && head.ETag && head.ETag.replaceAll('"', "") !== req.expectEtag.replaceAll('"', "")) {
+            return {
+                status: "inconsistent",
+                reasons: [
+                    {
+                        code: SQL_VERIFICATION_OUTCOME_CODE.OBJECT_DIGEST_MISMATCH,
+                        message: "ETag mismatch",
+                    },
+                ],
+                evidenceSummary: {},
+            };
+        }
+        if (req.expectSha256 !== undefined) {
+            if (contentLength > MAX_S3_BODY_HASH_BYTES) {
+                return {
+                    status: "inconsistent",
+                    reasons: [
+                        {
+                            code: SQL_VERIFICATION_OUTCOME_CODE.OBJECT_TOO_LARGE_FOR_HASH,
+                            message: `Object size ${contentLength} exceeds hash cap ${MAX_S3_BODY_HASH_BYTES}`,
+                        },
+                    ],
+                    evidenceSummary: { contentLength },
+                };
+            }
+            const get = await client.send(new GetObjectCommand({ Bucket: req.bucket, Key: req.key }));
+            const body = get.Body;
+            if (!body || typeof body.transformToByteArray !== "function") {
+                return setupError("S3 GetObject body missing or unsupported runtime");
+            }
+            const bytes = await body.transformToByteArray();
+            const hex = createHash("sha256").update(Buffer.from(bytes)).digest("hex");
+            if (hex !== req.expectSha256.toLowerCase()) {
+                return {
+                    status: "inconsistent",
+                    reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.OBJECT_DIGEST_MISMATCH, message: "SHA-256 mismatch" }],
+                    evidenceSummary: {},
+                };
+            }
+        }
+        return {
+            status: "verified",
+            reasons: [],
+            evidenceSummary: { s3: true, elapsedMs: Date.now() - started },
+        };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (String(msg).includes("NotFound") || String(msg).includes("404")) {
+            return {
+                status: "missing",
+                reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.OBJECT_MISSING, message: "S3 object not found" }],
+                evidenceSummary: {},
+            };
+        }
+        return {
+            status: "incomplete_verification",
+            reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.STATE_WITNESS_SETUP_ERROR, message: msg }],
+            evidenceSummary: {},
+        };
+    }
+}
+async function reconcileHttpWitness(req) {
+    try {
+        const r = await fetchWithDeadline(req.url, { method: req.method, headers: { Accept: "application/json" } }, 8000);
+        if (r.status !== req.expectedStatus) {
+            return {
+                status: "inconsistent",
+                reasons: [
+                    {
+                        code: SQL_VERIFICATION_OUTCOME_CODE.HTTP_WITNESS_STATUS_MISMATCH,
+                        message: `HTTP status ${r.status}, expected ${req.expectedStatus}`,
+                    },
+                ],
+                evidenceSummary: { httpStatus: r.status },
+            };
+        }
+        const text = await r.text();
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            parsed = text;
+        }
+        if (req.assertions && req.assertions.length > 0) {
+            if (typeof parsed !== "object" || parsed === null) {
+                return {
+                    status: "inconsistent",
+                    reasons: [
+                        {
+                            code: SQL_VERIFICATION_OUTCOME_CODE.HTTP_WITNESS_ASSERTION_MISMATCH,
+                            message: "Response is not a JSON object; cannot apply assertions",
+                        },
+                    ],
+                    evidenceSummary: {},
+                };
+            }
+            const o = parsed;
+            for (const a of req.assertions) {
+                const ptr = a.jsonPointer.startsWith("/") ? a.jsonPointer : `/${a.jsonPointer}`;
+                const act = getPointer(o, ptr);
+                const cmp = verificationScalarsEqual(a.value, act);
+                if (!cmp.ok) {
+                    return {
+                        status: "inconsistent",
+                        reasons: [
+                            {
+                                code: SQL_VERIFICATION_OUTCOME_CODE.HTTP_WITNESS_ASSERTION_MISMATCH,
+                                message: `Assertion ${ptr}: expected ${cmp.expected} found ${cmp.actual}`,
+                            },
+                        ],
+                        evidenceSummary: { jsonPointer: ptr },
+                    };
+                }
+            }
+        }
+        return { status: "verified", reasons: [], evidenceSummary: { http: true } };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return {
+            status: "incomplete_verification",
+            reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.HTTP_WITNESS_NETWORK_ERROR, message: msg }],
+            evidenceSummary: {},
+        };
+    }
+}
+async function reconcileMongo(req) {
+    const uri = process.env.AGENTSKEPTIC_MONGO_URL ?? process.env.MONGODB_URI;
+    if (!uri) {
+        return setupError("mongo_document: set AGENTSKEPTIC_MONGO_URL or MONGODB_URI");
+    }
+    const client = new MongoClient(uri);
+    try {
+        await client.connect();
+        const doc = await client.db().collection(req.collection).findOne(req.filter);
+        if (!doc) {
+            return {
+                status: "missing",
+                reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.MONGO_DOCUMENT_MISSING, message: "No document matched filter" }],
+                evidenceSummary: {},
+            };
+        }
+        const plain = doc;
+        for (const [k, exp] of Object.entries(req.requiredFields)) {
+            const act = plain[k];
+            const cmp = verificationScalarsEqual(exp, act);
+            if (!cmp.ok) {
+                return {
+                    status: "inconsistent",
+                    reasons: [
+                        {
+                            code: SQL_VERIFICATION_OUTCOME_CODE.MONGO_VALUE_MISMATCH,
+                            message: `${k}: expected ${cmp.expected} found ${cmp.actual}`,
+                        },
+                    ],
+                    evidenceSummary: { field: k },
+                };
+            }
+        }
+        return { status: "verified", reasons: [], evidenceSummary: { mongo: true } };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return {
+            status: "incomplete_verification",
+            reasons: [{ code: SQL_VERIFICATION_OUTCOME_CODE.STATE_WITNESS_SETUP_ERROR, message: msg }],
+            evidenceSummary: {},
+        };
+    }
+    finally {
+        await client.close().catch(() => { });
+    }
+}
+export async function reconcileStateWitness(req) {
+    switch (req.kind) {
+        case "vector_document":
+            return reconcileVectorDocument(req);
+        case "object_storage_object":
+            return reconcileObjectStorage(req);
+        case "http_witness":
+            return reconcileHttpWitness(req);
+        case "mongo_document":
+            return reconcileMongo(req);
+        default:
+            return setupError("unknown state witness kind");
+    }
+}
+//# sourceMappingURL=stateWitness.js.map

package/dist/stateWitness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stateWitness.js","sourceRoot":"","sources":["../src/stateWitness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAU9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO;QACL,MAAM,EAAE,yBAAyB;QACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1F,eAAe,EAAE,EAAE;KACpB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAiB,EAAE,UAAkB;IACjF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAS;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,WAAW,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,GAAsC;IAC3E,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,2EAA2E,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,IAAI,GACR,GAAG,CAAC,IAAI;QACR,CAAC,GAAG,CAAC,QAAQ,KAAK,UAAU;YAC1B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACjC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,UAAU;gBAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;gBAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CACf,oBAAoB,GAAG,CAAC,QAAQ,wFAAwF,CACzH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,GAAG,CAAC,QAAQ,KAAK,UAAU;QACzB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC9B,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,UAAU;YAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAC9B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,oBAAoB,GAAG,CAAC,QAAQ,wBAAwB,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,EAC1C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE;gBAClE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjG,CAAC;aACH,EACD,IAAI,CACL,CAAC;YACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,OAAO;oBACL,MAAM,EAAE,yBAAyB;oBACjC,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,6BAA6B,CAAC,qBAAqB;4BACzD,OAAO,EAAE,uBAAuB,CAAC,CAAC,MAAM,EAAE;yBAC3C;qBACF;oBACD,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;iBAC1C,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAyE,CAAC;YACtG,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,gBAAgB,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;oBAC5G,eAAe,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;iBAC5C,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC;oBACrE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;wBACZ,OAAO;4BACL,MAAM,EAAE,cAAc;4BACtB,OAAO,EAAE;gCACP;oCACE,IAAI,EAAE,6BAA6B,CAAC,wBAAwB;oCAC5D,OAAO,EAAE,YAAY,CAAC,cAAc,GAAG,CAAC,QAAQ,UAAU,GAAG,CAAC,MAAM,EAAE;iCACvE;6BACF;4BACD,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;yBAC9B,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YAClJ,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,gBAAgB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;oBACzG,eAAe,EAAE,EAAE;iBACpB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,OAAO;oBACL,MAAM,EAAE,yBAAyB;oBACjC,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,6BAA6B,CAAC,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,MAAM,EAAE,EAAE;qBACpG;oBACD,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;iBAC1C,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,IAAI,MAAM,EAC3D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACzG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;SAChD,EACD,IAAI,CACL,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO;gBACL,MAAM,EAAE,yBAAyB;gBACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,qBAAqB,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC5G,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;aAC1C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAuB,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,gBAAgB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;gBACtG,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;IACtF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO;YACL,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,qBAAqB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACtF,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;SACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,GAAqC;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;QAC1B,MAAM;QACN,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACxE,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;SACpG,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,aAAa,KAAK,GAAG,CAAC,eAAe,EAAE,CAAC;YAC/E,OAAO;gBACL,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,6BAA6B,CAAC,oBAAoB;wBACxD,OAAO,EAAE,iBAAiB,GAAG,CAAC,eAAe,0BAA0B,aAAa,EAAE;qBACvF;iBACF;gBACD,eAAe,EAAE,EAAE,aAAa,EAAE;aACnC,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;YACtH,OAAO;gBACL,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,6BAA6B,CAAC,sBAAsB;wBAC1D,OAAO,EAAE,eAAe;qBACzB;iBACF;gBACD,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,aAAa,GAAG,sBAAsB,EAAE,CAAC;gBAC3C,OAAO;oBACL,MAAM,EAAE,cAAc;oBACtB,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,6BAA6B,CAAC,yBAAyB;4BAC7D,OAAO,EAAE,eAAe,aAAa,qBAAqB,sBAAsB,EAAE;yBACnF;qBACF;oBACD,eAAe,EAAE,EAAE,aAAa,EAAE;iBACnC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,IAAI,OAAQ,IAA6D,CAAC,oBAAoB,KAAK,UAAU,EAAE,CAAC;gBACvH,OAAO,UAAU,CAAC,kDAAkD,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,KAAK,GAAG,MAAO,IAA4D,CAAC,oBAAoB,EAAE,CAAC;YACzG,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,GAAG,KAAK,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC3C,OAAO;oBACL,MAAM,EAAE,cAAc;oBACtB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,sBAAsB,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;oBACtG,eAAe,EAAE,EAAE;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,EAAE;YACX,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE;SAC/D,CAAC;IACJ,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;gBACjG,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC1F,eAAe,EAAE,EAAE;SACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,GAAmC;IACrE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,GAAG,CAAC,GAAG,EACP,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC/D,IAAI,CACL,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,CAAC;YACpC,OAAO;gBACL,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,6BAA6B,CAAC,4BAA4B;wBAChE,OAAO,EAAE,eAAe,CAAC,CAAC,MAAM,cAAc,GAAG,CAAC,cAAc,EAAE;qBACnE;iBACF;gBACD,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;aAC1C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClD,OAAO;oBACL,MAAM,EAAE,cAAc;oBACtB,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,6BAA6B,CAAC,+BAA+B;4BACnE,OAAO,EAAE,wDAAwD;yBAClE;qBACF;oBACD,eAAe,EAAE,EAAE;iBACpB,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,MAAiC,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAChF,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,KAAK,EAAE,GAAyB,CAAC,CAAC;gBACzE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,OAAO;wBACL,MAAM,EAAE,cAAc;wBACtB,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,6BAA6B,CAAC,+BAA+B;gCACnE,OAAO,EAAE,aAAa,GAAG,cAAc,GAAG,CAAC,QAAQ,UAAU,GAAG,CAAC,MAAM,EAAE;6BAC1E;yBACF;wBACD,eAAe,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;qBACtC,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO;YACL,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,0BAA0B,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC3F,eAAe,EAAE,EAAE;SACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAqC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC1E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,UAAU,CAAC,2DAA2D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,sBAAsB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;gBAChH,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,GAA8B,CAAC;QAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,EAAE,GAAyB,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO;oBACL,MAAM,EAAE,cAAc;oBACtB,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,6BAA6B,CAAC,oBAAoB;4BACxD,OAAO,EAAE,GAAG,CAAC,cAAc,GAAG,CAAC,QAAQ,UAAU,GAAG,CAAC,MAAM,EAAE;yBAC9D;qBACF;oBACD,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;iBAC9B,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;IAC/E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO;YACL,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,6BAA6B,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC1F,eAAe,EAAE,EAAE;SACpB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAwB;IAClE,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,iBAAiB;YACpB,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,uBAAuB;YAC1B,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,cAAc;YACjB,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACnC,KAAK,gBAAgB;YACnB,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B;YACE,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/stateWitness.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=stateWitness.test.d.ts.map

package/dist/stateWitness.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stateWitness.test.d.ts","sourceRoot":"","sources":["../src/stateWitness.test.ts"],"names":[],"mappings":""}

package/dist/stateWitness.test.js

@@ -0,0 +1,120 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+const s3Send = vi.hoisted(() => vi.fn());
+vi.mock("@aws-sdk/client-s3", () => ({
+    S3Client: class MockS3Client {
+        send = s3Send;
+    },
+    HeadObjectCommand: class HeadObjectCommand {
+        input;
+        constructor(input) {
+            this.input = input;
+        }
+    },
+    GetObjectCommand: class GetObjectCommand {
+        input;
+        constructor(input) {
+            this.input = input;
+        }
+    },
+}));
+import { reconcileStateWitness } from "./stateWitness.js";
+describe("reconcileStateWitness", () => {
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.restoreAllMocks();
+        s3Send.mockReset();
+    });
+    describe("http_witness", () => {
+        it("returns verified when status and JSON assertions match", async () => {
+            vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ ok: true, n: 1 }), { status: 200 })));
+            const out = await reconcileStateWitness({
+                kind: "http_witness",
+                method: "GET",
+                url: "http://witness.test/health",
+                expectedStatus: 200,
+                assertions: [{ jsonPointer: "/ok", value: true }],
+            });
+            expect(out.status).toBe("verified");
+        });
+        it("returns inconsistent on HTTP status mismatch", async () => {
+            vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({}), { status: 500 })));
+            const out = await reconcileStateWitness({
+                kind: "http_witness",
+                method: "GET",
+                url: "http://witness.test/x",
+                expectedStatus: 200,
+            });
+            expect(out.status).toBe("inconsistent");
+            expect(out.reasons[0]?.code).toBe("HTTP_WITNESS_STATUS_MISMATCH");
+        });
+    });
+    describe("vector_document (pinecone)", () => {
+        it("returns verified when fetch returns matching vector metadata", async () => {
+            const prevHost = process.env.PINECONE_INDEX_HOST;
+            const prevKey = process.env.PINECONE_API_KEY;
+            process.env.PINECONE_INDEX_HOST = "https://pinecone.test";
+            process.env.PINECONE_API_KEY = "secret";
+            try {
+                vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({
+                    vectors: { "doc-1": { metadata: { tier: "gold" } } },
+                }), { status: 200 })));
+                const out = await reconcileStateWitness({
+                    kind: "vector_document",
+                    provider: "pinecone",
+                    documentId: "doc-1",
+                    indexName: "idx",
+                    metadataSubset: { tier: "gold" },
+                });
+                expect(out.status).toBe("verified");
+            }
+            finally {
+                if (prevHost === undefined)
+                    delete process.env.PINECONE_INDEX_HOST;
+                else
+                    process.env.PINECONE_INDEX_HOST = prevHost;
+                if (prevKey === undefined)
+                    delete process.env.PINECONE_API_KEY;
+                else
+                    process.env.PINECONE_API_KEY = prevKey;
+            }
+        });
+    });
+    describe("object_storage_object", () => {
+        it("returns verified when HeadObject matches size and ETag", async () => {
+            s3Send.mockResolvedValueOnce({ ContentLength: 3, ETag: '"abc"' });
+            const out = await reconcileStateWitness({
+                kind: "object_storage_object",
+                bucket: "b",
+                key: "k",
+                expectSizeBytes: 3,
+                expectEtag: "abc",
+            });
+            expect(out.status).toBe("verified");
+            expect(s3Send).toHaveBeenCalledTimes(1);
+        });
+        it("returns inconsistent on ETag mismatch", async () => {
+            s3Send.mockResolvedValueOnce({ ContentLength: 3, ETag: '"wrong"' });
+            const out = await reconcileStateWitness({
+                kind: "object_storage_object",
+                bucket: "b",
+                key: "k",
+                expectEtag: "expected",
+            });
+            expect(out.status).toBe("inconsistent");
+            expect(out.reasons[0]?.code).toBe("OBJECT_DIGEST_MISMATCH");
+        });
+        it("returns inconsistent when full-object hash requested over byte cap", async () => {
+            const big = 11 * 1024 * 1024;
+            s3Send.mockResolvedValueOnce({ ContentLength: big, ETag: '"x"' });
+            const out = await reconcileStateWitness({
+                kind: "object_storage_object",
+                bucket: "b",
+                key: "k",
+                expectSha256: "a".repeat(64),
+            });
+            expect(out.status).toBe("inconsistent");
+            expect(out.reasons[0]?.code).toBe("OBJECT_TOO_LARGE_FOR_HASH");
+        });
+    });
+});
+//# sourceMappingURL=stateWitness.test.js.map

package/dist/stateWitness.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stateWitness.test.js","sourceRoot":"","sources":["../src/stateWitness.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAE7D,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAEzC,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,QAAQ,EAAE,MAAM,YAAY;QAC1B,IAAI,GAAG,MAAM,CAAC;KACf;IACD,iBAAiB,EAAE,MAAM,iBAAiB;QACZ;QAA5B,YAA4B,KAAc;YAAd,UAAK,GAAL,KAAK,CAAS;QAAG,CAAC;KAC/C;IACD,gBAAgB,EAAE,MAAM,gBAAgB;QACV;QAA5B,YAA4B,KAAc;YAAd,UAAK,GAAL,KAAK,CAAS;QAAG,CAAC;KAC/C;CACF,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,SAAS,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CACrF,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,4BAA4B;gBACjC,cAAc,EAAE,GAAG;gBACnB,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aAClD,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,uBAAuB;gBAC5B,cAAc,EAAE,GAAG;aACpB,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,uBAAuB,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC;YACxC,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CACX,OAAO,EACP,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CACf,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;iBACrD,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CACF,CACF,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;oBACtC,IAAI,EAAE,iBAAiB;oBACvB,QAAQ,EAAE,UAAU;oBACpB,UAAU,EAAE,OAAO;oBACnB,SAAS,EAAE,KAAK;oBAChB,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;iBACjC,CAAC,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,CAAC;oBAAS,CAAC;gBACT,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;;oBAC9D,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC;gBAChD,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;;oBAC1D,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC;YAC9C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,GAAG;gBACX,GAAG,EAAE,GAAG;gBACR,eAAe,EAAE,CAAC;gBAClB,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACpE,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,GAAG;gBACX,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,UAAU;aACvB,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;gBACtC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,GAAG;gBACX,GAAG,EAAE,GAAG;gBACR,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;aAC7B,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/telemetry/ossClaimOrigin.d.ts

@@ -1,6 +1,6 @@
 /**
  * OSS claim-ticket POST base (v1): canonical public site origin only — no env overrides.
- * Normative: docs/oss-account-claim-ssot.md
+ * Normative: docs/oss-account-claim.md
  */
 export declare function resolveOssClaimApiOrigin(): string;
 //# sourceMappingURL=ossClaimOrigin.d.ts.map

package/dist/telemetry/ossClaimOrigin.js

@@ -1,7 +1,7 @@
 import { PUBLIC_CANONICAL_SITE_ORIGIN } from "../publicDistribution.generated.js";
 /**
  * OSS claim-ticket POST base (v1): canonical public site origin only — no env overrides.
- * Normative: docs/oss-account-claim-ssot.md
+ * Normative: docs/oss-account-claim.md
  */
 export function resolveOssClaimApiOrigin() {
     return PUBLIC_CANONICAL_SITE_ORIGIN.replace(/\/$/, "");

package/dist/telemetry/verificationHypothesisContract.d.ts

@@ -1,6 +1,6 @@
 /**
  * Canonical rules for optional `verification_hypothesis` on product-activation wire (schema_version 2).
- * @see docs/funnel-observability-ssot.md (field semantics; charset lives only here).
+ * @see docs/funnel-observability.md (field semantics; charset lives only here).
  */
 export declare const VERIFICATION_HYPOTHESIS_MIN_LEN = 1;
 export declare const VERIFICATION_HYPOTHESIS_MAX_LEN = 240;

package/dist/telemetry/verificationHypothesisContract.js

@@ -1,6 +1,6 @@
 /**
  * Canonical rules for optional `verification_hypothesis` on product-activation wire (schema_version 2).
- * @see docs/funnel-observability-ssot.md (field semantics; charset lives only here).
+ * @see docs/funnel-observability.md (field semantics; charset lives only here).
  */
 export const VERIFICATION_HYPOTHESIS_MIN_LEN = 1;
 export const VERIFICATION_HYPOTHESIS_MAX_LEN = 240;