caveat-cli 0.20.3 → 0.21.1

package/dist/privateEvidence/validation.js

@@ -0,0 +1,1077 @@
+#!/usr/bin/env node
+import { createRequire as __caveat_createRequire } from 'node:module';
+const require = __caveat_createRequire(import.meta.url);
+
+// src/privateEvidence/validation.ts
+import { createHash } from "node:crypto";
+import { TextDecoder, isDeepStrictEqual } from "node:util";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { visit } from "jsonc-parser";
+
+// src/contracts/factory-private-evidence/capability.v1.schema.json
+var capability_v1_schema_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "urn:caveat:factory-private-evidence-capability:v1",
+  title: "Draft: Caveat official private evidence capability v1",
+  type: "object",
+  additionalProperties: false,
+  required: [
+    "schema",
+    "product",
+    "package_version",
+    "public_diagnostic_schema",
+    "private_protocol",
+    "transports",
+    "max_channel_bytes",
+    "operation_receipt"
+  ],
+  properties: {
+    schema: {
+      const: "caveat.factory_private_evidence_capability.v1"
+    },
+    product: {
+      const: "caveat"
+    },
+    package_version: {
+      type: "string",
+      pattern: "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$",
+      maxLength: 128
+    },
+    public_diagnostic_schema: {
+      const: "caveat.native_factory_diagnostics.v1"
+    },
+    private_protocol: {
+      const: "caveat.factory_private_evidence.v1"
+    },
+    transports: {
+      type: "array",
+      maxItems: 2,
+      uniqueItems: true,
+      items: {
+        oneOf: [
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "id",
+              "platforms",
+              "launch_paths"
+            ],
+            properties: {
+              id: {
+                const: "posix-fd-v1"
+              },
+              platforms: {
+                type: "array",
+                minItems: 1,
+                maxItems: 2,
+                uniqueItems: true,
+                items: {
+                  enum: [
+                    "linux",
+                    "darwin"
+                  ]
+                }
+              },
+              launch_paths: {
+                type: "array",
+                minItems: 1,
+                maxItems: 1,
+                uniqueItems: true,
+                items: {
+                  enum: [
+                    "direct_node_entry"
+                  ]
+                }
+              }
+            }
+          },
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "id",
+              "platforms",
+              "launch_paths"
+            ],
+            properties: {
+              id: {
+                const: "windows-named-pipe-v1"
+              },
+              platforms: {
+                type: "array",
+                minItems: 1,
+                maxItems: 1,
+                uniqueItems: true,
+                items: {
+                  enum: [
+                    "win32"
+                  ]
+                }
+              },
+              launch_paths: {
+                type: "array",
+                minItems: 1,
+                maxItems: 2,
+                uniqueItems: true,
+                items: {
+                  enum: [
+                    "native_exe",
+                    "powershell_standard_shim"
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      },
+      allOf: [
+        {
+          contains: {
+            type: "object",
+            required: [
+              "id"
+            ],
+            properties: {
+              id: {
+                const: "posix-fd-v1"
+              }
+            }
+          },
+          minContains: 0,
+          maxContains: 1
+        },
+        {
+          contains: {
+            type: "object",
+            required: [
+              "id"
+            ],
+            properties: {
+              id: {
+                const: "windows-named-pipe-v1"
+              }
+            }
+          },
+          minContains: 0,
+          maxContains: 1
+        }
+      ]
+    },
+    max_channel_bytes: {
+      const: 16384
+    },
+    operation_receipt: {
+      const: "not_supported"
+    }
+  }
+};
+
+// src/contracts/factory-private-evidence/private-frame.v1.schema.json
+var private_frame_v1_schema_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "urn:caveat:factory-private-evidence:v1",
+  title: "Draft: Caveat official private evidence NDJSON frame v1",
+  oneOf: [
+    {
+      type: "object",
+      additionalProperties: false,
+      required: [
+        "schema",
+        "collection_id",
+        "nonce",
+        "execution_id",
+        "type",
+        "product",
+        "product_version",
+        "public_diagnostic_schema",
+        "transport",
+        "process"
+      ],
+      properties: {
+        schema: {
+          const: "caveat.factory_private_evidence.v1"
+        },
+        collection_id: {
+          type: "string",
+          pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+        },
+        nonce: {
+          type: "string",
+          pattern: "^[0-9a-f]{64}$"
+        },
+        execution_id: {
+          type: "string",
+          pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+        },
+        type: {
+          const: "hello"
+        },
+        product: {
+          const: "caveat"
+        },
+        product_version: {
+          type: "string",
+          pattern: "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$",
+          maxLength: 128
+        },
+        public_diagnostic_schema: {
+          const: "caveat.native_factory_diagnostics.v1"
+        },
+        transport: {
+          enum: [
+            "posix-fd-v1",
+            "windows-named-pipe-v1"
+          ]
+        },
+        process: {
+          type: "object",
+          additionalProperties: false,
+          required: [
+            "pid",
+            "parent_pid",
+            "start_identity",
+            "identity",
+            "exec_path",
+            "entry_realpath",
+            "package_version",
+            "build_id",
+            "missing_reasons"
+          ],
+          properties: {
+            pid: {
+              type: "integer",
+              minimum: 1,
+              maximum: 9007199254740991
+            },
+            parent_pid: {
+              anyOf: [
+                {
+                  type: "integer",
+                  minimum: 0,
+                  maximum: 9007199254740991
+                },
+                {
+                  type: "null"
+                }
+              ]
+            },
+            start_identity: {
+              type: "object",
+              additionalProperties: false,
+              required: [
+                "source",
+                "value"
+              ],
+              properties: {
+                source: {
+                  enum: [
+                    "linux_proc_start",
+                    "windows_process_creation",
+                    "os_process_start",
+                    "unavailable"
+                  ]
+                },
+                value: {
+                  anyOf: [
+                    {
+                      type: "string",
+                      minLength: 1,
+                      maxLength: 256
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                }
+              },
+              allOf: [
+                {
+                  if: {
+                    properties: {
+                      source: {
+                        const: "unavailable"
+                      }
+                    }
+                  },
+                  then: {
+                    properties: {
+                      value: {
+                        type: "null"
+                      }
+                    }
+                  },
+                  else: {
+                    properties: {
+                      value: {
+                        type: "string"
+                      }
+                    }
+                  }
+                }
+              ]
+            },
+            identity: {
+              type: "object",
+              additionalProperties: false,
+              required: [
+                "kind",
+                "uid",
+                "gid",
+                "sid"
+              ],
+              properties: {
+                kind: {
+                  enum: [
+                    "uid_gid",
+                    "windows_sid",
+                    "unknown"
+                  ]
+                },
+                uid: {
+                  anyOf: [
+                    {
+                      type: "integer",
+                      minimum: 0,
+                      maximum: 9007199254740991
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                gid: {
+                  anyOf: [
+                    {
+                      type: "integer",
+                      minimum: 0,
+                      maximum: 9007199254740991
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                sid: {
+                  anyOf: [
+                    {
+                      type: "string",
+                      pattern: "^S-1-[0-9]+(?:-[0-9]+)+$",
+                      maxLength: 256
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                }
+              },
+              allOf: [
+                {
+                  if: {
+                    properties: {
+                      kind: {
+                        const: "uid_gid"
+                      }
+                    }
+                  },
+                  then: {
+                    properties: {
+                      uid: {
+                        type: "integer"
+                      },
+                      gid: {
+                        type: "integer"
+                      },
+                      sid: {
+                        type: "null"
+                      }
+                    }
+                  }
+                },
+                {
+                  if: {
+                    properties: {
+                      kind: {
+                        const: "windows_sid"
+                      }
+                    }
+                  },
+                  then: {
+                    properties: {
+                      uid: {
+                        type: "null"
+                      },
+                      gid: {
+                        type: "null"
+                      },
+                      sid: {
+                        type: "string"
+                      }
+                    }
+                  }
+                },
+                {
+                  if: {
+                    properties: {
+                      kind: {
+                        const: "unknown"
+                      }
+                    }
+                  },
+                  then: {
+                    properties: {
+                      uid: {
+                        type: "null"
+                      },
+                      gid: {
+                        type: "null"
+                      },
+                      sid: {
+                        type: "null"
+                      }
+                    }
+                  }
+                }
+              ]
+            },
+            exec_path: {
+              anyOf: [
+                {
+                  type: "string",
+                  minLength: 1,
+                  maxLength: 4096
+                },
+                {
+                  type: "null"
+                }
+              ]
+            },
+            entry_realpath: {
+              anyOf: [
+                {
+                  type: "string",
+                  minLength: 1,
+                  maxLength: 4096
+                },
+                {
+                  type: "null"
+                }
+              ]
+            },
+            package_version: {
+              type: "string",
+              pattern: "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$",
+              maxLength: 128
+            },
+            build_id: {
+              anyOf: [
+                {
+                  type: "string",
+                  minLength: 1,
+                  maxLength: 256
+                },
+                {
+                  type: "null"
+                }
+              ]
+            },
+            missing_reasons: {
+              type: "array",
+              uniqueItems: true,
+              items: {
+                enum: [
+                  "parent_identity_unavailable",
+                  "start_identity_unavailable",
+                  "actor_identity_unavailable",
+                  "exec_path_unavailable",
+                  "entry_path_unavailable",
+                  "build_id_unavailable"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      type: "object",
+      additionalProperties: false,
+      required: [
+        "schema",
+        "collection_id",
+        "nonce",
+        "execution_id",
+        "type",
+        "public_output",
+        "public_result",
+        "sync_observation",
+        "operation_receipt"
+      ],
+      properties: {
+        schema: {
+          const: "caveat.factory_private_evidence.v1"
+        },
+        collection_id: {
+          type: "string",
+          pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+        },
+        nonce: {
+          type: "string",
+          pattern: "^[0-9a-f]{64}$"
+        },
+        execution_id: {
+          type: "string",
+          pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+        },
+        type: {
+          const: "diagnostic_result"
+        },
+        public_output: {
+          type: "object",
+          additionalProperties: false,
+          required: [
+            "bytes",
+            "sha256"
+          ],
+          properties: {
+            bytes: {
+              type: "integer",
+              minimum: 0,
+              maximum: 9007199254740991
+            },
+            sha256: {
+              type: "string",
+              pattern: "^[0-9a-f]{64}$"
+            }
+          }
+        },
+        public_result: {
+          type: "object",
+          additionalProperties: false,
+          required: [
+            "schema",
+            "overall_status",
+            "planned_exit_code"
+          ],
+          properties: {
+            schema: {
+              const: "caveat.native_factory_diagnostics.v1"
+            },
+            overall_status: {
+              enum: [
+                "ready",
+                "not_ready",
+                "unverified"
+              ]
+            },
+            planned_exit_code: {
+              enum: [
+                0,
+                1
+              ]
+            }
+          },
+          allOf: [
+            {
+              if: {
+                properties: {
+                  overall_status: {
+                    const: "ready"
+                  }
+                }
+              },
+              then: {
+                properties: {
+                  planned_exit_code: {
+                    const: 0
+                  }
+                }
+              },
+              else: {
+                properties: {
+                  planned_exit_code: {
+                    const: 1
+                  }
+                }
+              }
+            }
+          ]
+        },
+        sync_observation: {
+          type: "object",
+          additionalProperties: false,
+          required: [
+            "status",
+            "reason_code",
+            "repo_identity",
+            "local_head",
+            "remote_head",
+            "comparison",
+            "relation_counts"
+          ],
+          properties: {
+            status: {
+              enum: [
+                "ready",
+                "not_ready",
+                "unverified"
+              ]
+            },
+            reason_code: {
+              type: "string",
+              pattern: "^[a-z][a-z0-9_]{0,63}$"
+            },
+            repo_identity: {
+              type: "object",
+              additionalProperties: false,
+              required: [
+                "status",
+                "algorithm",
+                "digest",
+                "reason"
+              ],
+              properties: {
+                status: {
+                  enum: [
+                    "available",
+                    "not_observed",
+                    "unverified"
+                  ]
+                },
+                algorithm: {
+                  anyOf: [
+                    {
+                      const: "origin-descriptor-sha256-v1"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                digest: {
+                  anyOf: [
+                    {
+                      type: "string",
+                      pattern: "^[0-9a-f]{64}$"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                reason: {
+                  enum: [
+                    "origin_descriptor_observed",
+                    "origin_not_reached",
+                    "origin_capture_unverified",
+                    "origin_syntax_unsupported",
+                    "origin_semantics_ambiguous"
+                  ]
+                }
+              },
+              allOf: [
+                {
+                  if: {
+                    properties: {
+                      status: {
+                        const: "available"
+                      }
+                    }
+                  },
+                  then: {
+                    properties: {
+                      algorithm: {
+                        const: "origin-descriptor-sha256-v1"
+                      },
+                      digest: {
+                        type: "string",
+                        pattern: "^[0-9a-f]{64}$"
+                      },
+                      reason: {
+                        const: "origin_descriptor_observed"
+                      }
+                    }
+                  },
+                  else: {
+                    properties: {
+                      algorithm: {
+                        type: "null"
+                      },
+                      digest: {
+                        type: "null"
+                      }
+                    }
+                  }
+                },
+                {
+                  if: {
+                    properties: {
+                      status: {
+                        const: "not_observed"
+                      }
+                    }
+                  },
+                  then: {
+                    properties: {
+                      reason: {
+                        const: "origin_not_reached"
+                      }
+                    }
+                  }
+                },
+                {
+                  if: {
+                    properties: {
+                      status: {
+                        const: "unverified"
+                      }
+                    }
+                  },
+                  then: {
+                    properties: {
+                      reason: {
+                        enum: [
+                          "origin_capture_unverified",
+                          "origin_syntax_unsupported",
+                          "origin_semantics_ambiguous"
+                        ]
+                      }
+                    }
+                  }
+                }
+              ]
+            },
+            local_head: {
+              type: "object",
+              additionalProperties: false,
+              required: [
+                "status",
+                "value",
+                "reason"
+              ],
+              properties: {
+                status: {
+                  enum: [
+                    "observed",
+                    "not_observed",
+                    "unverified"
+                  ]
+                },
+                value: {
+                  anyOf: [
+                    {
+                      type: "string",
+                      pattern: "^[0-9a-f]{40}$"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                reason: {
+                  type: "string",
+                  pattern: "^[a-z][a-z0-9_]{0,63}$"
+                }
+              },
+              allOf: [
+                {
+                  if: {
+                    properties: {
+                      status: {
+                        const: "observed"
+                      }
+                    }
+                  },
+                  then: {
+                    properties: {
+                      value: {
+                        type: "string",
+                        pattern: "^[0-9a-f]{40}$"
+                      }
+                    }
+                  },
+                  else: {
+                    properties: {
+                      value: {
+                        type: "null"
+                      }
+                    }
+                  }
+                }
+              ]
+            },
+            remote_head: {
+              type: "object",
+              additionalProperties: false,
+              required: [
+                "status",
+                "value",
+                "reason"
+              ],
+              properties: {
+                status: {
+                  enum: [
+                    "observed",
+                    "not_observed",
+                    "unverified"
+                  ]
+                },
+                value: {
+                  anyOf: [
+                    {
+                      type: "string",
+                      pattern: "^[0-9a-f]{40}$"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ]
+                },
+                reason: {
+                  type: "string",
+                  pattern: "^[a-z][a-z0-9_]{0,63}$"
+                }
+              },
+              allOf: [
+                {
+                  if: {
+                    properties: {
+                      status: {
+                        const: "observed"
+                      }
+                    }
+                  },
+                  then: {
+                    properties: {
+                      value: {
+                        type: "string",
+                        pattern: "^[0-9a-f]{40}$"
+                      }
+                    }
+                  },
+                  else: {
+                    properties: {
+                      value: {
+                        type: "null"
+                      }
+                    }
+                  }
+                }
+              ]
+            },
+            comparison: {
+              enum: [
+                "equal",
+                "different",
+                "not_evaluated"
+              ]
+            },
+            relation_counts: {
+              type: "object",
+              additionalProperties: false,
+              required: [
+                "status",
+                "behind",
+                "ahead"
+              ],
+              properties: {
+                status: {
+                  const: "not_supported"
+                },
+                behind: {
+                  type: "null"
+                },
+                ahead: {
+                  type: "null"
+                }
+              }
+            }
+          }
+        },
+        operation_receipt: {
+          type: "object",
+          additionalProperties: false,
+          required: [
+            "status",
+            "receipt"
+          ],
+          properties: {
+            status: {
+              const: "not_supported"
+            },
+            receipt: {
+              type: "null"
+            }
+          }
+        }
+      }
+    }
+  ]
+};
+
+// src/contracts/factory-private-evidence/windows-channel.v1.schema.json
+var windows_channel_v1_schema_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "urn:caveat:factory-private-evidence-windows-channel:v1",
+  title: "Draft: local Windows private channel descriptor",
+  type: "object",
+  additionalProperties: false,
+  required: [
+    "transport",
+    "path",
+    "server_pid",
+    "server_start_identity",
+    "owner_sid"
+  ],
+  properties: {
+    transport: {
+      const: "windows-named-pipe-v1"
+    },
+    path: {
+      type: "string",
+      pattern: "^\\\\\\\\\\.\\\\pipe\\\\caveat-evidence-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+    },
+    server_pid: {
+      type: "integer",
+      minimum: 1,
+      maximum: 9007199254740991
+    },
+    server_start_identity: {
+      type: "string",
+      minLength: 1,
+      maxLength: 256
+    },
+    owner_sid: {
+      type: "string",
+      pattern: "^S-1-[0-9]+(?:-[0-9]+)+$",
+      maxLength: 256
+    }
+  }
+};
+
+// src/privateEvidence/validation.ts
+var ajv = new Ajv2020({ strict: true, strictRequired: false });
+var validateCapability = ajv.compile(capability_v1_schema_default);
+var validateFrame = ajv.compile(private_frame_v1_schema_default);
+var validateWindowsDescriptor = ajv.compile(windows_channel_v1_schema_default);
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var NONCE = /^[0-9a-f]{64}$/;
+var MAX_CHANNEL_BYTES = 16384;
+function strictJson(bytes, limit = MAX_CHANNEL_BYTES) {
+  if (bytes.byteLength === 0 || bytes.byteLength > limit) throw new Error("json_budget");
+  const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+  const objects = [];
+  let depth = 0, invalid = false;
+  visit(text, {
+    onObjectBegin() {
+      if (++depth > 32) throw new Error("json_depth");
+      objects.push(/* @__PURE__ */ new Set());
+    },
+    onObjectProperty(key) {
+      const keys = objects.at(-1);
+      if (keys.has(key)) invalid = true;
+      keys.add(key);
+    },
+    onObjectEnd() {
+      objects.pop();
+      depth--;
+    },
+    onArrayBegin() {
+      if (++depth > 32) throw new Error("json_depth");
+    },
+    onArrayEnd() {
+      depth--;
+    },
+    onError() {
+      invalid = true;
+    }
+  }, { disallowComments: true, allowTrailingComma: false, allowEmptyContent: false });
+  if (invalid || depth !== 0 || objects.length !== 0) throw new Error("json_invalid");
+  return JSON.parse(text);
+}
+function validateRequest(env) {
+  if (env.CAVEAT_FACTORY_PRIVATE_EVIDENCE !== "v1") return { status: "off" };
+  const collection = env.CAVEAT_FACTORY_PRIVATE_COLLECTION_ID;
+  const nonce = env.CAVEAT_FACTORY_PRIVATE_NONCE;
+  const channel = env.CAVEAT_FACTORY_PRIVATE_CHANNEL;
+  if (!collection || !UUID.test(collection) || !nonce || !NONCE.test(nonce) || !channel || channel.length > MAX_CHANNEL_BYTES)
+    return { status: "unverified", reason: "request_invalid" };
+  if (channel === "fd:3") return { status: "valid", collection_id: collection, nonce, transport: "posix-fd-v1" };
+  try {
+    const descriptor = strictJson(Buffer.from(channel));
+    if (validateWindowsDescriptor(descriptor))
+      return { status: "valid", collection_id: collection, nonce, transport: "windows-named-pipe-v1" };
+  } catch {
+  }
+  return { status: "unverified", reason: "request_invalid" };
+}
+function selectCapability(request, capability, expectedVersion, platform, launchPath) {
+  if (request.status === "off") return { status: "off" };
+  if (request.status !== "valid") return { status: "unverified", reason: "request_invalid" };
+  if (capability == null) return { status: "not_supported", reason: "capability_absent" };
+  if (!validateCapability(capability) || capability.package_version !== expectedVersion)
+    return { status: "unverified", reason: "capability_invalid" };
+  const common = capability.transports.some((t) => t.id === request.transport && t.platforms.includes(platform) && t.launch_paths.includes(launchPath));
+  return common ? { status: "candidate_requires_os_verification" } : { status: "not_supported", reason: "transport_unsupported" };
+}
+function validateExchange(input) {
+  const bad = (reason) => ({ status: "unverified", reason });
+  try {
+    if (input.request.status !== "valid" || input.eof !== true || input.peerVerified !== true) return bad("channel_incomplete");
+    if (!validateCapability(input.capability) || input.capability.package_version !== input.expectedVersion)
+      return bad("capability_invalid");
+    if (input.channelBytes.byteLength > MAX_CHANNEL_BYTES) return bad("channel_budget");
+    const bytes = Buffer.from(input.channelBytes);
+    if (bytes.at(-1) !== 10) return bad("frame_framing");
+    const lines = bytes.toString("latin1").split("\n");
+    if (lines.length !== 3 || lines[2] !== "") return bad("frame_framing");
+    const frames = lines.slice(0, 2).map((line) => strictJson(Buffer.from(line, "latin1")));
+    if (frames.some((frame) => !validateFrame(frame))) return bad("frame_schema");
+    const [hello, result] = frames;
+    if (hello.type !== "hello" || result.type !== "diagnostic_result") return bad("frame_order");
+    if (!UUID.test(hello.execution_id)) return bad("frame_identity");
+    for (const key of ["schema", "collection_id", "nonce", "execution_id"])
+      if (hello[key] !== result[key]) return bad("frame_identity");
+    if (hello.collection_id !== input.request.collection_id || hello.nonce !== input.request.nonce || hello.product_version !== input.expectedVersion || hello.process.package_version !== input.expectedVersion || hello.transport !== input.request.transport) return bad("frame_identity");
+    if (selectCapability(input.request, input.capability, input.expectedVersion, input.platform, input.launchPath).status !== "candidate_requires_os_verification") return bad("transport_unsupported");
+    const p = hello.process;
+    if (!input.expectedProcess || !isDeepStrictEqual(p, input.expectedProcess)) return bad("peer_identity");
+    const needed = [];
+    for (const [key, reason] of [
+      ["parent_pid", "parent_identity_unavailable"],
+      ["exec_path", "exec_path_unavailable"],
+      ["entry_realpath", "entry_path_unavailable"],
+      ["build_id", "build_id_unavailable"]
+    ])
+      if (p[key] === null) needed.push(reason);
+    if (p.start_identity.source === "unavailable") needed.push("start_identity_unavailable");
+    if (p.identity.kind === "unknown") needed.push("actor_identity_unavailable");
+    if (!isDeepStrictEqual([...needed].sort(), [...p.missing_reasons].sort())) return bad("process_missing_reason");
+    if (input.publicBytes.at(-1) !== 10 || input.publicBytes.subarray(0, -1).includes(10)) return bad("public_framing");
+    const pub = strictJson(input.publicBytes, 65536);
+    if (pub.schema !== hello.public_diagnostic_schema || pub.product !== "caveat" || pub.version !== input.expectedVersion || pub.overall?.status !== result.public_result.overall_status || pub.sync?.status !== result.sync_observation.status || pub.sync?.reason_code !== result.sync_observation.reason_code) return bad("public_mismatch");
+    if (result.public_output.bytes !== input.publicBytes.byteLength || result.public_output.sha256 !== createHash("sha256").update(input.publicBytes).digest("hex")) return bad("public_bytes_mismatch");
+    const sync = result.sync_observation;
+    const both = sync.local_head.status === "observed" && sync.remote_head.status === "observed";
+    const comparison = both ? sync.local_head.value === sync.remote_head.value ? "equal" : "different" : "not_evaluated";
+    if (sync.comparison !== comparison) return bad("head_comparison");
+    const repo = sync.repo_identity;
+    const allowed = repo.status === "available" ? ["origin_descriptor_observed"] : repo.status === "not_observed" ? ["origin_not_reached"] : ["origin_capture_unverified", "origin_syntax_unsupported", "origin_semantics_ambiguous"];
+    if (!allowed.includes(repo.reason)) return bad("origin_reason");
+    return { status: "valid", reason: "complete_synthetic_exchange" };
+  } catch {
+    return bad("exchange_invalid");
+  }
+}
+export {
+  MAX_CHANNEL_BYTES,
+  UUID,
+  selectCapability,
+  strictJson,
+  validateCapability,
+  validateExchange,
+  validateFrame,
+  validateRequest,
+  validateWindowsDescriptor
+};
+//# sourceMappingURL=validation.js.map