caveat-cli 0.20.2 → 0.21.0

package/dist/privateEvidence/candidate.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { createRequire as __caveat_createRequire } from 'node:module';
+const require = __caveat_createRequire(import.meta.url);
+import "../chunk-TWJDSUZ4.js";
+
+// src/privateEvidence/candidate.ts
+function planOptionalEvidence(enabled, publicBytes, exitCode, prepare) {
+  if (enabled !== true) return { publicBytes, exitCode, privateCandidate: null, privateStatus: "off" };
+  try {
+    return { publicBytes, exitCode, privateCandidate: prepare(), privateStatus: "prepared" };
+  } catch {
+    return { publicBytes, exitCode, privateCandidate: null, privateStatus: "unverified" };
+  }
+}
+export {
+  planOptionalEvidence
+};
+//# sourceMappingURL=candidate.js.map

package/dist/privateEvidence/candidate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/privateEvidence/candidate.ts"],"sourcesContent":["/** Isolation-only planning boundary. No CLI import, transport, filesystem or delivery integration. */\nexport function planOptionalEvidence<T>(enabled: boolean, publicBytes: Uint8Array, exitCode: number,\n  prepare: () => T): { publicBytes: Uint8Array; exitCode: number; privateCandidate: T | null; privateStatus: string } {\n  if (enabled !== true) return { publicBytes, exitCode, privateCandidate: null, privateStatus: 'off' };\n  try { return { publicBytes, exitCode, privateCandidate: prepare(), privateStatus: 'prepared' }; }\n  catch { return { publicBytes, exitCode, privateCandidate: null, privateStatus: 'unverified' }; }\n}\n"],"mappings":";;;;;;AACO,SAAS,qBAAwB,SAAkB,aAAyB,UACjF,SAAoH;AACpH,MAAI,YAAY,KAAM,QAAO,EAAE,aAAa,UAAU,kBAAkB,MAAM,eAAe,MAAM;AACnG,MAAI;AAAE,WAAO,EAAE,aAAa,UAAU,kBAAkB,QAAQ,GAAG,eAAe,WAAW;AAAA,EAAG,QAC1F;AAAE,WAAO,EAAE,aAAa,UAAU,kBAAkB,MAAM,eAAe,aAAa;AAAA,EAAG;AACjG;","names":[]}

package/dist/privateEvidence/origin.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { createRequire as __caveat_createRequire } from 'node:module';
+const require = __caveat_createRequire(import.meta.url);
+import "../chunk-TWJDSUZ4.js";
+
+// src/privateEvidence/origin.ts
+import { createHash } from "node:crypto";
+var ORIGIN_ALGORITHM = "origin-descriptor-sha256-v1";
+var missing = (status, reason) => ({ status, algorithm: null, digest: null, reason });
+function hasKnownCaptureState(input) {
+  return input.complete === true && (input.status === "observed" || input.status === "not_observed" || input.status === "unverified");
+}
+function projectOrigin(runId, input) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(runId) || input.run_id !== runId || !hasKnownCaptureState(input) || input.status === "unverified")
+    return missing("unverified", "origin_capture_unverified");
+  if (input.status === "not_observed") return missing("not_observed", "origin_not_reached");
+  if (typeof input.value !== "string") return missing("unverified", "origin_capture_unverified");
+  const text = input.value.replace(/\r?\n$/, "");
+  const unsupported = () => missing("unverified", "origin_syntax_unsupported");
+  if (!text || text.length > 4096 || /[^\x21-\x7e]|[%\\?#]/.test(text)) return unsupported();
+  let form;
+  let scheme = null;
+  let host;
+  let port = null;
+  let path;
+  if (text.includes("://")) {
+    const parsed = /^(https?|ssh|git):\/\/(?:[A-Za-z0-9._-]+@)?([^/:@]+)(?::([1-9][0-9]{0,4}))?(\/.*)$/i.exec(text);
+    if (!parsed) return unsupported();
+    form = "url";
+    scheme = parsed[1].toLowerCase();
+    host = parsed[2];
+    port = parsed[3] ?? null;
+    path = parsed[4];
+    if (port !== null && Number(port) > 65535) return unsupported();
+  } else {
+    const parsed = /^(?:[A-Za-z0-9._-]+@)?([^/:@]+):(.*)$/.exec(text);
+    if (!parsed) return unsupported();
+    if (!parsed[2].startsWith("/")) return missing("unverified", "origin_semantics_ambiguous");
+    form = "scp";
+    host = parsed[1];
+    path = parsed[2];
+  }
+  const labels = host.split(".");
+  if (host.length > 253 || labels.every((label) => /^[0-9]+$/.test(label)) || labels.some((label) => !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(label))) return unsupported();
+  if (!/^\/[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*\/?$/.test(path) || path.split("/").some((segment) => segment === "." || segment === "..")) return unsupported();
+  const tuple = ["caveat.origin-descriptor.v1", form, scheme, host.toLowerCase(), port, "absolute", path];
+  return {
+    status: "available",
+    algorithm: ORIGIN_ALGORITHM,
+    digest: createHash("sha256").update(JSON.stringify(tuple), "utf8").digest("hex"),
+    reason: "origin_descriptor_observed"
+  };
+}
+function projectHead(runId, input) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(runId) || input.run_id !== runId || !hasKnownCaptureState(input) || input.status === "unverified")
+    return { status: "unverified", value: null, reason: "head_capture_unverified" };
+  if (input.status === "not_observed") return { status: "not_observed", value: null, reason: "head_not_reached" };
+  if (typeof input.value !== "string" || !/^[0-9a-f]{40}$/.test(input.value))
+    return { status: "unverified", value: null, reason: "head_format_unsupported" };
+  return { status: "observed", value: input.value, reason: "head_observed" };
+}
+function projectSync(runId, acquired, publicSync) {
+  const local = projectHead(runId, acquired.local), remote = projectHead(runId, acquired.remote);
+  return {
+    ...publicSync,
+    repo_identity: projectOrigin(runId, acquired.origin),
+    local_head: local,
+    remote_head: remote,
+    comparison: local.status === "observed" && remote.status === "observed" ? local.value === remote.value ? "equal" : "different" : "not_evaluated",
+    relation_counts: { status: "not_supported", behind: null, ahead: null }
+  };
+}
+export {
+  ORIGIN_ALGORITHM,
+  projectHead,
+  projectOrigin,
+  projectSync
+};
+//# sourceMappingURL=origin.js.map

package/dist/privateEvidence/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/privateEvidence/origin.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nexport const ORIGIN_ALGORITHM = 'origin-descriptor-sha256-v1';\nexport type OriginIdentity = {\n  status: 'available' | 'not_observed' | 'unverified';\n  algorithm: typeof ORIGIN_ALGORITHM | null;\n  digest: string | null;\n  reason: string;\n};\nexport type AcquiredValue = {\n  run_id: string;\n  status: 'observed' | 'not_observed' | 'unverified';\n  value: string | null;\n  complete: boolean;\n};\nconst missing = (status: 'not_observed' | 'unverified', reason: string): OriginIdentity =>\n  ({ status, algorithm: null, digest: null, reason });\n\nfunction hasKnownCaptureState(input: AcquiredValue): boolean {\n  return input.complete === true &&\n    (input.status === 'observed' || input.status === 'not_observed' || input.status === 'unverified');\n}\n\n/** Input is an already acquired value; never queries Git, config, DNS, files or state. */\nexport function projectOrigin(runId: string, input: AcquiredValue): OriginIdentity {\n  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(runId) || input.run_id !== runId || !hasKnownCaptureState(input) || input.status === 'unverified')\n    return missing('unverified', 'origin_capture_unverified');\n  if (input.status === 'not_observed') return missing('not_observed', 'origin_not_reached');\n  if (typeof input.value !== 'string') return missing('unverified', 'origin_capture_unverified');\n  const text = input.value.replace(/\\r?\\n$/, '');\n  const unsupported = () => missing('unverified', 'origin_syntax_unsupported');\n  if (!text || text.length > 4096 || /[^\\x21-\\x7e]|[%\\\\?#]/.test(text)) return unsupported();\n  let form: 'url' | 'scp';\n  let scheme: string | null = null;\n  let host: string;\n  let port: string | null = null;\n  let path: string;\n  if (text.includes('://')) {\n    const parsed = /^(https?|ssh|git):\\/\\/(?:[A-Za-z0-9._-]+@)?([^/:@]+)(?::([1-9][0-9]{0,4}))?(\\/.*)$/i.exec(text);\n    if (!parsed) return unsupported();\n    form = 'url'; scheme = parsed[1]!.toLowerCase(); host = parsed[2]!; port = parsed[3] ?? null; path = parsed[4]!;\n    if (port !== null && Number(port) > 65535) return unsupported();\n  } else {\n    const parsed = /^(?:[A-Za-z0-9._-]+@)?([^/:@]+):(.*)$/.exec(text);\n    if (!parsed) return unsupported();\n    if (!parsed[2]!.startsWith('/')) return missing('unverified', 'origin_semantics_ambiguous');\n    form = 'scp'; host = parsed[1]!; path = parsed[2]!;\n  }\n  const labels = host.split('.');\n  if (host.length > 253 || labels.every(label => /^[0-9]+$/.test(label)) ||\n      labels.some(label => !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(label))) return unsupported();\n  if (!/^\\/[A-Za-z0-9._-]+(?:\\/[A-Za-z0-9._-]+)*\\/?$/.test(path) ||\n      path.split('/').some(segment => segment === '.' || segment === '..')) return unsupported();\n  const tuple = ['caveat.origin-descriptor.v1', form, scheme, host.toLowerCase(), port, 'absolute', path];\n  return { status: 'available', algorithm: ORIGIN_ALGORITHM,\n    digest: createHash('sha256').update(JSON.stringify(tuple), 'utf8').digest('hex'), reason: 'origin_descriptor_observed' };\n}\n\nexport function projectHead(runId: string, input: AcquiredValue) {\n  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(runId) || input.run_id !== runId || !hasKnownCaptureState(input) || input.status === 'unverified')\n    return { status: 'unverified', value: null, reason: 'head_capture_unverified' } as const;\n  if (input.status === 'not_observed') return { status: 'not_observed', value: null, reason: 'head_not_reached' } as const;\n  if (typeof input.value !== 'string' || !/^[0-9a-f]{40}$/.test(input.value))\n    return { status: 'unverified', value: null, reason: 'head_format_unsupported' } as const;\n  return { status: 'observed', value: input.value, reason: 'head_observed' } as const;\n}\n\nexport function projectSync(runId: string, acquired: {\n  origin: AcquiredValue; local: AcquiredValue; remote: AcquiredValue;\n}, publicSync: { status: 'ready' | 'not_ready' | 'unverified'; reason_code: string }) {\n  const local = projectHead(runId, acquired.local), remote = projectHead(runId, acquired.remote);\n  return { ...publicSync, repo_identity: projectOrigin(runId, acquired.origin), local_head: local, remote_head: remote,\n    comparison: local.status === 'observed' && remote.status === 'observed'\n      ? local.value === remote.value ? 'equal' : 'different' : 'not_evaluated',\n    relation_counts: { status: 'not_supported', behind: null, ahead: null } };\n}\n"],"mappings":";;;;;;AAAA,SAAS,kBAAkB;AAEpB,IAAM,mBAAmB;AAahC,IAAM,UAAU,CAAC,QAAuC,YACrD,EAAE,QAAQ,WAAW,MAAM,QAAQ,MAAM,OAAO;AAEnD,SAAS,qBAAqB,OAA+B;AAC3D,SAAO,MAAM,aAAa,SACvB,MAAM,WAAW,cAAc,MAAM,WAAW,kBAAkB,MAAM,WAAW;AACxF;AAGO,SAAS,cAAc,OAAe,OAAsC;AACjF,MAAI,CAAC,iEAAiE,KAAK,KAAK,KAAK,MAAM,WAAW,SAAS,CAAC,qBAAqB,KAAK,KAAK,MAAM,WAAW;AAC9J,WAAO,QAAQ,cAAc,2BAA2B;AAC1D,MAAI,MAAM,WAAW,eAAgB,QAAO,QAAQ,gBAAgB,oBAAoB;AACxF,MAAI,OAAO,MAAM,UAAU,SAAU,QAAO,QAAQ,cAAc,2BAA2B;AAC7F,QAAM,OAAO,MAAM,MAAM,QAAQ,UAAU,EAAE;AAC7C,QAAM,cAAc,MAAM,QAAQ,cAAc,2BAA2B;AAC3E,MAAI,CAAC,QAAQ,KAAK,SAAS,QAAQ,uBAAuB,KAAK,IAAI,EAAG,QAAO,YAAY;AACzF,MAAI;AACJ,MAAI,SAAwB;AAC5B,MAAI;AACJ,MAAI,OAAsB;AAC1B,MAAI;AACJ,MAAI,KAAK,SAAS,KAAK,GAAG;AACxB,UAAM,SAAS,sFAAsF,KAAK,IAAI;AAC9G,QAAI,CAAC,OAAQ,QAAO,YAAY;AAChC,WAAO;AAAO,aAAS,OAAO,CAAC,EAAG,YAAY;AAAG,WAAO,OAAO,CAAC;AAAI,WAAO,OAAO,CAAC,KAAK;AAAM,WAAO,OAAO,CAAC;AAC7G,QAAI,SAAS,QAAQ,OAAO,IAAI,IAAI,MAAO,QAAO,YAAY;AAAA,EAChE,OAAO;AACL,UAAM,SAAS,wCAAwC,KAAK,IAAI;AAChE,QAAI,CAAC,OAAQ,QAAO,YAAY;AAChC,QAAI,CAAC,OAAO,CAAC,EAAG,WAAW,GAAG,EAAG,QAAO,QAAQ,cAAc,4BAA4B;AAC1F,WAAO;AAAO,WAAO,OAAO,CAAC;AAAI,WAAO,OAAO,CAAC;AAAA,EAClD;AACA,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,KAAK,SAAS,OAAO,OAAO,MAAM,WAAS,WAAW,KAAK,KAAK,CAAC,KACjE,OAAO,KAAK,WAAS,CAAC,kDAAkD,KAAK,KAAK,CAAC,EAAG,QAAO,YAAY;AAC7G,MAAI,CAAC,+CAA+C,KAAK,IAAI,KACzD,KAAK,MAAM,GAAG,EAAE,KAAK,aAAW,YAAY,OAAO,YAAY,IAAI,EAAG,QAAO,YAAY;AAC7F,QAAM,QAAQ,CAAC,+BAA+B,MAAM,QAAQ,KAAK,YAAY,GAAG,MAAM,YAAY,IAAI;AACtG,SAAO;AAAA,IAAE,QAAQ;AAAA,IAAa,WAAW;AAAA,IACvC,QAAQ,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,KAAK,GAAG,MAAM,EAAE,OAAO,KAAK;AAAA,IAAG,QAAQ;AAAA,EAA6B;AAC3H;AAEO,SAAS,YAAY,OAAe,OAAsB;AAC/D,MAAI,CAAC,iEAAiE,KAAK,KAAK,KAAK,MAAM,WAAW,SAAS,CAAC,qBAAqB,KAAK,KAAK,MAAM,WAAW;AAC9J,WAAO,EAAE,QAAQ,cAAc,OAAO,MAAM,QAAQ,0BAA0B;AAChF,MAAI,MAAM,WAAW,eAAgB,QAAO,EAAE,QAAQ,gBAAgB,OAAO,MAAM,QAAQ,mBAAmB;AAC9G,MAAI,OAAO,MAAM,UAAU,YAAY,CAAC,iBAAiB,KAAK,MAAM,KAAK;AACvE,WAAO,EAAE,QAAQ,cAAc,OAAO,MAAM,QAAQ,0BAA0B;AAChF,SAAO,EAAE,QAAQ,YAAY,OAAO,MAAM,OAAO,QAAQ,gBAAgB;AAC3E;AAEO,SAAS,YAAY,OAAe,UAExC,YAAmF;AACpF,QAAM,QAAQ,YAAY,OAAO,SAAS,KAAK,GAAG,SAAS,YAAY,OAAO,SAAS,MAAM;AAC7F,SAAO;AAAA,IAAE,GAAG;AAAA,IAAY,eAAe,cAAc,OAAO,SAAS,MAAM;AAAA,IAAG,YAAY;AAAA,IAAO,aAAa;AAAA,IAC5G,YAAY,MAAM,WAAW,cAAc,OAAO,WAAW,aACzD,MAAM,UAAU,OAAO,QAAQ,UAAU,cAAc;AAAA,IAC3D,iBAAiB,EAAE,QAAQ,iBAAiB,QAAQ,MAAM,OAAO,KAAK;AAAA,EAAE;AAC5E;","names":[]}