clinkx 1.1.0 → 1.1.2

package/dist/project-verification/contract.d.ts

@@ -0,0 +1,537 @@
+import { z } from "zod";
+export declare const RelativeFile: z.ZodEffects<z.ZodString, string, string>;
+export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    inputs: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+    checks: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        command: z.ZodEffects<z.ZodString, string, string>;
+        args: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+        cwd: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<".">, z.ZodEffects<z.ZodString, string, string>]>>;
+        timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        env_allowlist: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        timeout_seconds: number;
+        args: string[];
+        command: string;
+        env_allowlist: string[];
+        cwd: string;
+        id: string;
+    }, {
+        args: string[];
+        command: string;
+        id: string;
+        timeout_seconds?: number | undefined;
+        env_allowlist?: string[] | undefined;
+        cwd?: string | undefined;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    version: 1;
+    inputs: string[];
+    checks: {
+        timeout_seconds: number;
+        args: string[];
+        command: string;
+        env_allowlist: string[];
+        cwd: string;
+        id: string;
+    }[];
+}, {
+    version: 1;
+    inputs: string[];
+    checks: {
+        args: string[];
+        command: string;
+        id: string;
+        timeout_seconds?: number | undefined;
+        env_allowlist?: string[] | undefined;
+        cwd?: string | undefined;
+    }[];
+}>, {
+    version: 1;
+    inputs: string[];
+    checks: {
+        timeout_seconds: number;
+        args: string[];
+        command: string;
+        env_allowlist: string[];
+        cwd: string;
+        id: string;
+    }[];
+}, {
+    version: 1;
+    inputs: string[];
+    checks: {
+        args: string[];
+        command: string;
+        id: string;
+        timeout_seconds?: number | undefined;
+        env_allowlist?: string[] | undefined;
+        cwd?: string | undefined;
+    }[];
+}>;
+export type Manifest = z.infer<typeof ManifestSchema>;
+export declare const FileFactSchema: z.ZodObject<{
+    path: z.ZodEffects<z.ZodString, string, string>;
+    size_bytes: z.ZodNumber;
+    sha256: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    path: string;
+    sha256: string;
+    size_bytes: number;
+}, {
+    path: string;
+    sha256: string;
+    size_bytes: number;
+}>;
+export declare const ExpectedSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    project: z.ZodString;
+    manifest_path: z.ZodEffects<z.ZodString, string, string>;
+    manifest: z.ZodEffects<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        inputs: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+        checks: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            command: z.ZodEffects<z.ZodString, string, string>;
+            args: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+            cwd: z.ZodDefault<z.ZodUnion<[z.ZodLiteral<".">, z.ZodEffects<z.ZodString, string, string>]>>;
+            timeout_seconds: z.ZodDefault<z.ZodNumber>;
+            env_allowlist: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        }, "strict", z.ZodTypeAny, {
+            timeout_seconds: number;
+            args: string[];
+            command: string;
+            env_allowlist: string[];
+            cwd: string;
+            id: string;
+        }, {
+            args: string[];
+            command: string;
+            id: string;
+            timeout_seconds?: number | undefined;
+            env_allowlist?: string[] | undefined;
+            cwd?: string | undefined;
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        version: 1;
+        inputs: string[];
+        checks: {
+            timeout_seconds: number;
+            args: string[];
+            command: string;
+            env_allowlist: string[];
+            cwd: string;
+            id: string;
+        }[];
+    }, {
+        version: 1;
+        inputs: string[];
+        checks: {
+            args: string[];
+            command: string;
+            id: string;
+            timeout_seconds?: number | undefined;
+            env_allowlist?: string[] | undefined;
+            cwd?: string | undefined;
+        }[];
+    }>, {
+        version: 1;
+        inputs: string[];
+        checks: {
+            timeout_seconds: number;
+            args: string[];
+            command: string;
+            env_allowlist: string[];
+            cwd: string;
+            id: string;
+        }[];
+    }, {
+        version: 1;
+        inputs: string[];
+        checks: {
+            args: string[];
+            command: string;
+            id: string;
+            timeout_seconds?: number | undefined;
+            env_allowlist?: string[] | undefined;
+            cwd?: string | undefined;
+        }[];
+    }>;
+    inputs: z.ZodArray<z.ZodObject<{
+        path: z.ZodEffects<z.ZodString, string, string>;
+        size_bytes: z.ZodNumber;
+        sha256: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }, {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }>, "many">;
+    node_version: z.ZodString;
+    expectations: z.ZodEffects<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        identity: z.ZodObject<{
+            source_sha256: z.ZodString;
+            build_sha256: z.ZodString;
+            procedure_sha256: z.ZodString;
+            boundary: z.ZodEnum<["workflow-handoff-fixture", "project-command-v1"]>;
+        }, "strict", z.ZodTypeAny, {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        }, {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        }>;
+        checks: z.ZodArray<z.ZodObject<{
+            check_id: z.ZodString;
+            attempt_id: z.ZodString;
+            producer: z.ZodString;
+            artifact_path: z.ZodEffects<z.ZodString, string, string>;
+        }, "strict", z.ZodTypeAny, {
+            check_id: string;
+            artifact_path: string;
+            attempt_id: string;
+            producer: string;
+        }, {
+            check_id: string;
+            artifact_path: string;
+            attempt_id: string;
+            producer: string;
+        }>, "many">;
+        superseded_attempts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            check_id: z.ZodString;
+            attempt_id: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            check_id: string;
+            attempt_id: string;
+        }, {
+            check_id: string;
+            attempt_id: string;
+        }>, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        version: 1;
+        checks: {
+            check_id: string;
+            artifact_path: string;
+            attempt_id: string;
+            producer: string;
+        }[];
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        };
+        superseded_attempts: {
+            check_id: string;
+            attempt_id: string;
+        }[];
+    }, {
+        version: 1;
+        checks: {
+            check_id: string;
+            artifact_path: string;
+            attempt_id: string;
+            producer: string;
+        }[];
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        };
+        superseded_attempts?: {
+            check_id: string;
+            attempt_id: string;
+        }[] | undefined;
+    }>, {
+        version: 1;
+        checks: {
+            check_id: string;
+            artifact_path: string;
+            attempt_id: string;
+            producer: string;
+        }[];
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        };
+        superseded_attempts: {
+            check_id: string;
+            attempt_id: string;
+        }[];
+    }, {
+        version: 1;
+        checks: {
+            check_id: string;
+            artifact_path: string;
+            attempt_id: string;
+            producer: string;
+        }[];
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        };
+        superseded_attempts?: {
+            check_id: string;
+            attempt_id: string;
+        }[] | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    version: 1;
+    inputs: {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }[];
+    project: string;
+    manifest_path: string;
+    manifest: {
+        version: 1;
+        inputs: string[];
+        checks: {
+            timeout_seconds: number;
+            args: string[];
+            command: string;
+            env_allowlist: string[];
+            cwd: string;
+            id: string;
+        }[];
+    };
+    node_version: string;
+    expectations: {
+        version: 1;
+        checks: {
+            check_id: string;
+            artifact_path: string;
+            attempt_id: string;
+            producer: string;
+        }[];
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        };
+        superseded_attempts: {
+            check_id: string;
+            attempt_id: string;
+        }[];
+    };
+}, {
+    version: 1;
+    inputs: {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }[];
+    project: string;
+    manifest_path: string;
+    manifest: {
+        version: 1;
+        inputs: string[];
+        checks: {
+            args: string[];
+            command: string;
+            id: string;
+            timeout_seconds?: number | undefined;
+            env_allowlist?: string[] | undefined;
+            cwd?: string | undefined;
+        }[];
+    };
+    node_version: string;
+    expectations: {
+        version: 1;
+        checks: {
+            check_id: string;
+            artifact_path: string;
+            attempt_id: string;
+            producer: string;
+        }[];
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        };
+        superseded_attempts?: {
+            check_id: string;
+            attempt_id: string;
+        }[] | undefined;
+    };
+}>;
+export declare const ResultSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    check_id: z.ZodString;
+    attempt_id: z.ZodString;
+    source_before_sha256: z.ZodString;
+    source_after_sha256: z.ZodNullable<z.ZodString>;
+    exit_code: z.ZodNullable<z.ZodNumber>;
+    signal: z.ZodNullable<z.ZodString>;
+    reason: z.ZodEnum<["passed", "nonzero_exit", "spawn_error", "timeout", "cancelled", "capture_limit", "cleanup_failure"]>;
+    cleanup_ok: z.ZodBoolean;
+    stdout: z.ZodObject<{
+        path: z.ZodEffects<z.ZodString, string, string>;
+        size_bytes: z.ZodNumber;
+        sha256: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }, {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }>;
+    stderr: z.ZodObject<{
+        path: z.ZodEffects<z.ZodString, string, string>;
+        size_bytes: z.ZodNumber;
+        sha256: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }, {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    reason: "cancelled" | "timeout" | "passed" | "nonzero_exit" | "spawn_error" | "capture_limit" | "cleanup_failure";
+    version: 1;
+    signal: string | null;
+    stdout: {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    };
+    stderr: {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    };
+    check_id: string;
+    attempt_id: string;
+    source_before_sha256: string;
+    source_after_sha256: string | null;
+    exit_code: number | null;
+    cleanup_ok: boolean;
+}, {
+    reason: "cancelled" | "timeout" | "passed" | "nonzero_exit" | "spawn_error" | "capture_limit" | "cleanup_failure";
+    version: 1;
+    signal: string | null;
+    stdout: {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    };
+    stderr: {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    };
+    check_id: string;
+    attempt_id: string;
+    source_before_sha256: string;
+    source_after_sha256: string | null;
+    exit_code: number | null;
+    cleanup_ok: boolean;
+}>;
+export declare const ObservationsSchema: z.ZodArray<z.ZodObject<{
+    check_id: z.ZodString;
+    attempt_id: z.ZodString;
+    producer: z.ZodString;
+    identity: z.ZodObject<{
+        source_sha256: z.ZodString;
+        build_sha256: z.ZodString;
+        procedure_sha256: z.ZodString;
+        boundary: z.ZodEnum<["workflow-handoff-fixture", "project-command-v1"]>;
+    }, "strict", z.ZodTypeAny, {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    }, {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    }>;
+    provenance: z.ZodEnum<["trusted_host", "provider"]>;
+    result: z.ZodEnum<["passed", "failed", "producer_failed", "evidence_missing"]>;
+    artifact: z.ZodOptional<z.ZodObject<{
+        path: z.ZodEffects<z.ZodString, string, string>;
+        size_bytes: z.ZodNumber;
+        sha256: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }, {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    }>>;
+    reason: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    result: "failed" | "passed" | "producer_failed" | "evidence_missing";
+    provenance: "trusted_host" | "provider";
+    check_id: string;
+    identity: {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    };
+    attempt_id: string;
+    producer: string;
+    reason?: string | undefined;
+    artifact?: {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    } | undefined;
+}, {
+    result: "failed" | "passed" | "producer_failed" | "evidence_missing";
+    provenance: "trusted_host" | "provider";
+    check_id: string;
+    identity: {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    };
+    attempt_id: string;
+    producer: string;
+    reason?: string | undefined;
+    artifact?: {
+        path: string;
+        sha256: string;
+        size_bytes: number;
+    } | undefined;
+}>, "many">;
+export declare const CompletionSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    observations_sha256: z.ZodString;
+    interrupted_signal: z.ZodNullable<z.ZodEnum<["SIGINT", "SIGTERM", "cancelled"]>>;
+}, "strict", z.ZodTypeAny, {
+    version: 1;
+    observations_sha256: string;
+    interrupted_signal: "cancelled" | "SIGINT" | "SIGTERM" | null;
+}, {
+    version: 1;
+    observations_sha256: string;
+    interrupted_signal: "cancelled" | "SIGINT" | "SIGTERM" | null;
+}>;

package/dist/project-verification/contract.js

@@ -0,0 +1,40 @@
+import { z } from "zod";
+import { VerificationExpectationsSchema, VerificationObservationSchema } from "../../clinkx-workflows/dist/verification-proof.js";
+export const RelativeFile = z.string().min(1).max(512).refine((value) => !value.includes("\\") && !/^[A-Za-z]:/.test(value) && !/[\u0000-\u001f\u007f]/.test(value)
+    && value.split("/").every((part) => part !== "" && part !== "." && part !== ".."), "expected a project-relative path without traversal");
+const Identifier = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/);
+const Digest = z.string().regex(/^[a-f0-9]{64}$/);
+export const ManifestSchema = z.object({
+    version: z.literal(1),
+    inputs: z.array(RelativeFile).min(1).max(1000),
+    checks: z.array(z.object({
+        id: Identifier,
+        command: z.string().min(1).max(4096).refine((value) => !value.includes("\0")),
+        args: z.array(z.string().max(8192).refine((value) => !value.includes("\0"))).max(100),
+        cwd: z.union([z.literal("."), RelativeFile]).default("."),
+        timeout_seconds: z.number().int().min(1).max(3600).default(300),
+        env_allowlist: z.array(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/)).max(100).default([]),
+    }).strict()).min(1).max(100),
+}).strict().superRefine((value, context) => {
+    for (const [name, entries] of [["inputs", value.inputs], ["checks", value.checks.map((check) => check.id)]]) {
+        if (new Set(entries).size !== entries.length)
+            context.addIssue({ code: z.ZodIssueCode.custom, path: [name], message: "duplicate entry" });
+    }
+});
+export const FileFactSchema = z.object({ path: RelativeFile, size_bytes: z.number().int().min(0).max(16 * 1024 * 1024), sha256: Digest }).strict();
+export const ExpectedSchema = z.object({
+    version: z.literal(1), project: z.string().min(1), manifest_path: RelativeFile,
+    manifest: ManifestSchema, inputs: z.array(FileFactSchema).min(1).max(1000),
+    node_version: z.string().min(1), expectations: VerificationExpectationsSchema,
+}).strict();
+export const ResultSchema = z.object({
+    version: z.literal(1), check_id: Identifier, attempt_id: z.string().min(1).max(128),
+    source_before_sha256: Digest, source_after_sha256: Digest.nullable(),
+    exit_code: z.number().int().nullable(), signal: z.string().nullable(),
+    reason: z.enum(["passed", "nonzero_exit", "spawn_error", "timeout", "cancelled", "capture_limit", "cleanup_failure"]),
+    cleanup_ok: z.boolean(), stdout: FileFactSchema, stderr: FileFactSchema,
+}).strict();
+export const ObservationsSchema = z.array(VerificationObservationSchema).max(100);
+export const CompletionSchema = z.object({ version: z.literal(1), observations_sha256: Digest,
+    interrupted_signal: z.enum(["SIGINT", "SIGTERM", "cancelled"]).nullable() }).strict();
+//# sourceMappingURL=contract.js.map

package/dist/project-verification/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/project-verification/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAElI,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACtE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;OACvF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EACnF,oDAAoD,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACxE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACvB,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7E,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACrF,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACzD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAC/D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1F,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAU,EAAE,CAAC;QACrH,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC5I,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACnJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY;IAC9E,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,8BAA8B;CAC9E,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnF,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,QAAQ,EAAE;IACpE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACrH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc;CACxE,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM;IAC3F,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/project-verification/files.d.ts

@@ -0,0 +1,23 @@
+import { type Manifest } from "./contract.js";
+export declare const sha: (bytes: string | Buffer) => string;
+export declare const json: (value: unknown) => string;
+export declare function inside(root: string, target: string): boolean;
+export declare function safePath(root: string, path: string, directory?: boolean): string;
+export declare function readBounded(root: string, path: string, cap?: number): Buffer;
+export declare function fileFact(root: string, path: string): {
+    path: string;
+    size_bytes: number;
+    sha256: string;
+};
+export declare function snapshot(project: string, manifest: Manifest): {
+    path: string;
+    size_bytes: number;
+    sha256: string;
+}[];
+export declare function readManifest(project: string, path: string): {
+    manifest: Manifest;
+    sha256: string;
+};
+export declare function save(root: string, path: string, value: unknown): void;
+export declare const PACKAGE_ROOT: string;
+export declare function runtimeDigest(): string;

package/dist/project-verification/files.js

@@ -0,0 +1,80 @@
+import { createHash } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { ManifestSchema } from "./contract.js";
+export const sha = (bytes) => createHash("sha256").update(bytes).digest("hex");
+export const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
+export function inside(root, target) {
+    const path = relative(root, target);
+    return path === "" || (!isAbsolute(path) && path !== ".." && !path.startsWith(`..${sep}`));
+}
+export function safePath(root, path, directory = false) {
+    const target = resolve(root, path);
+    if (!inside(root, target))
+        throw Object.assign(new Error("path escapes its root"), { code: "E_PATH_UNSAFE" });
+    let current = root;
+    for (const part of relative(root, target).split(sep).filter(Boolean)) {
+        current = join(current, part);
+        if (lstatSync(current).isSymbolicLink())
+            throw Object.assign(new Error("symlink paths are not supported"), { code: "E_PATH_UNSAFE" });
+    }
+    const info = lstatSync(target);
+    if (directory ? !info.isDirectory() : !info.isFile())
+        throw new Error("path has the wrong file type");
+    return target;
+}
+export function readBounded(root, path, cap = 16 * 1024 * 1024) {
+    const fd = openSync(safePath(root, path), constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const info = fstatSync(fd);
+        if (!info.isFile() || info.size > cap)
+            throw new Error("input exceeds its file bound");
+        const bytes = Buffer.alloc(info.size + 1);
+        let count = 0;
+        while (count < bytes.length) {
+            const read = readSync(fd, bytes, count, bytes.length - count, null);
+            if (read === 0)
+                break;
+            count += read;
+        }
+        if (count !== info.size)
+            throw new Error("input changed size while reading");
+        return bytes.subarray(0, count);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function fileFact(root, path) {
+    const bytes = readBounded(root, path);
+    return { path, size_bytes: bytes.length, sha256: sha(bytes) };
+}
+export function snapshot(project, manifest) {
+    let total = 0;
+    return manifest.inputs.map((path) => {
+        const fact = fileFact(project, path);
+        total += fact.size_bytes;
+        if (total > 64 * 1024 * 1024)
+            throw new Error("declared inputs exceed 64 MiB");
+        return fact;
+    });
+}
+export function readManifest(project, path) {
+    const bytes = readBounded(project, path, 256 * 1024);
+    return { manifest: ManifestSchema.parse(JSON.parse(bytes.toString("utf8"))), sha256: sha(bytes) };
+}
+export function save(root, path, value) {
+    writeFileSync(join(root, path), json(value), { mode: 0o600, flag: "wx" });
+}
+export const PACKAGE_ROOT = realpathSync(fileURLToPath(new URL("../../", import.meta.url)));
+export function runtimeDigest() {
+    const paths = ["package.json", "dist/verification-tools.js", "dist/provider-doctor.js", "dist/project-verification/contract.js",
+        "dist/project-verification/files.js", "dist/project-verification/process.js", "dist/project-verification/runner.js",
+        "dist/project-verification/service.js", "dist/verified-repair/host.js", "dist/verified-repair/files.js", "dist/allowed-roots.js",
+        "clinkx-workflows/dist/verified-repair/contract.js", "clinkx-workflows/dist/contained-file.js", "dist/context-builder/secrets.js",
+        "clinkx-workflows/dist/dashboard/session-log-redaction.js",
+        "clinkx-workflows/dist/verification-proof.js", "scripts/provider-doctor-core.mjs", "scripts/provider-doctor-probe.mjs"];
+    return sha(json(paths.map((path) => fileFact(PACKAGE_ROOT, path))));
+}
+//# sourceMappingURL=files.js.map