forge-workflow 0.1.0-beta.4 → 0.1.0-beta.6

package/lib/bun-workflow-pins.js

@@ -0,0 +1,461 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { randomUUID } = require('node:crypto');
+const { secureExecFileSync } = require('./shell-utils');
+const {
+	createProtectedStateAuditRecord,
+	recordProtectedStateAuditEvent,
+	removeProtectedFile,
+	writeProtectedFile,
+} = require('./protected-state-surfaces');
+
+const EXACT_BUN_VERSION = /^\d+\.\d+\.\d+$/;
+const BUN_WORKFLOW_SPECS = Object.freeze([
+	{ path: '.github/workflows/build-binary.yml', key: 'BUN_VERSION', count: 1 },
+	{ path: '.github/workflows/docs-validation.yml', key: 'bun-version', count: 2 },
+	{ path: '.github/workflows/eslint.yml', key: 'bun-version', count: 1 },
+	{ path: '.github/workflows/pr-monitor.yml', key: 'bun-version', count: 1 },
+	{ path: '.github/workflows/required-checks-bypass.yml', key: 'bun-version', count: 1 },
+	{ path: '.github/workflows/size-check.yml', key: 'bun-version', count: 1 },
+	{ path: '.github/workflows/test.yml', key: 'bun-version', count: 8 },
+	{ path: '.github/workflows/yaml-lint.yml', key: 'bun-version', count: 1 },
+].map(Object.freeze));
+
+function workflowSpec(workflowPath) {
+	return BUN_WORKFLOW_SPECS.find(spec => spec.path === workflowPath) || null;
+}
+
+function readPinnedBunVersion(packageContent) {
+	let manifest;
+	try {
+		manifest = JSON.parse(Buffer.from(packageContent).toString('utf8'));
+	} catch (error) {
+		throw new Error(`Could not parse package.json: ${error.message}`);
+	}
+	const match = /^bun@(\d+\.\d+\.\d+)$/.exec(manifest.packageManager || '');
+	if (!match) throw new Error('package.json packageManager must pin one exact stable Bun version.');
+	return match[1];
+}
+
+function renderBunWorkflowPin(workflowPath, sourceContent, version) {
+	const spec = workflowSpec(workflowPath);
+	if (!spec) throw new Error(`${workflowPath} is not an allowlisted Bun workflow.`);
+	if (!EXACT_BUN_VERSION.test(version)) throw new Error('Bun workflow pins require an exact stable version.');
+
+	let replacements = 0;
+	const source = Buffer.from(sourceContent).toString('utf8');
+	const key = spec.key === 'BUN_VERSION' ? 'BUN_VERSION' : 'bun-version';
+	const pattern = new RegExp(`^([ \\t]*${key}:[ \\t]*)(?:latest|\\d+\\.\\d+\\.\\d+)([ \\t]*\\r?)$`, 'gm');
+	const rendered = source.replace(pattern, (_match, prefix, suffix) => {
+		replacements += 1;
+		return `${prefix}${version}${suffix}`;
+	});
+	if (replacements !== spec.count) {
+		throw new Error(`${workflowPath} must contain exactly ${spec.count} literal ${key} pin${spec.count === 1 ? '' : 's'}; found ${replacements}.`);
+	}
+	return Buffer.isBuffer(sourceContent) ? Buffer.from(rendered, 'utf8') : rendered;
+}
+
+function readSourceWorkflow(projectRoot, sourceHead, workflowPath, execGit = secureExecFileSync) {
+	if (!workflowSpec(workflowPath)) throw new Error(`${workflowPath} is not an allowlisted Bun workflow.`);
+	const gitOptions = {
+		cwd: projectRoot,
+		encoding: 'utf8',
+		stdio: ['ignore', 'pipe', 'pipe'],
+		windowsHide: true,
+	};
+	const treeEntry = execGit('git', ['ls-tree', sourceHead, '--', workflowPath], gitOptions).trim();
+	if (!/^100(?:644|755) blob [0-9a-f]+\t/.test(treeEntry)) {
+		throw new Error(`${workflowPath} is not a regular workflow file at ${sourceHead}.`);
+	}
+	return Buffer.from(execGit('git', ['show', `${sourceHead}:${workflowPath}`], {
+		...gitOptions,
+		encoding: 'buffer',
+	}));
+}
+
+function resolveCurrentHead(projectRoot, execGit = secureExecFileSync) {
+	return execGit('git', ['rev-parse', '--verify', 'HEAD^{commit}'], {
+		cwd: projectRoot,
+		encoding: 'utf8',
+		stdio: ['ignore', 'pipe', 'pipe'],
+		windowsHide: true,
+	}).trim();
+}
+
+function readIndexedWorkflow(projectRoot, workflowPath, execGit = secureExecFileSync) {
+	if (!workflowSpec(workflowPath)) throw new Error(`${workflowPath} is not an allowlisted Bun workflow.`);
+	const options = {
+		cwd: projectRoot,
+		encoding: 'utf8',
+		stdio: ['ignore', 'pipe', 'pipe'],
+		windowsHide: true,
+	};
+	const entry = execGit('git', ['ls-files', '--stage', '--', workflowPath], options).trim();
+	if (!/^100(?:644|755) [0-9a-f]+ 0\t/.test(entry)) {
+		throw new Error(`${workflowPath} is not one regular file in the Git index.`);
+	}
+	return Buffer.from(execGit('git', ['show', `:${workflowPath}`], { ...options, encoding: 'buffer' }));
+}
+
+function readIndexedPackageManifest(projectRoot, execGit = secureExecFileSync) {
+	const options = {
+		cwd: projectRoot,
+		encoding: 'utf8',
+		stdio: ['ignore', 'pipe', 'pipe'],
+		windowsHide: true,
+	};
+	const entry = execGit('git', ['ls-files', '--stage', '--', 'package.json'], options).trim();
+	if (!/^100(?:644|755) [0-9a-f]+ 0\tpackage\.json$/.test(entry)) {
+		throw new Error('package.json is not one regular file in the Git index.');
+	}
+	return Buffer.from(execGit('git', ['show', ':package.json'], { ...options, encoding: 'buffer' }));
+}
+
+function readSourcePackageManifest(projectRoot, sourceHead, execGit = secureExecFileSync) {
+	const options = {
+		cwd: projectRoot,
+		encoding: 'utf8',
+		stdio: ['ignore', 'pipe', 'pipe'],
+		windowsHide: true,
+	};
+	const entry = execGit('git', ['ls-tree', sourceHead, '--', 'package.json'], options).trim();
+	if (!/^100(?:644|755) blob [0-9a-f]+\tpackage\.json$/.test(entry)) {
+		throw new Error(`package.json is not a regular file at ${sourceHead}.`);
+	}
+	return Buffer.from(execGit('git', ['show', `${sourceHead}:package.json`], { ...options, encoding: 'buffer' }));
+}
+
+function resolveBunVersionTarget(projectRoot, options = {}) {
+	const indexReader = options.readIndexedPackageManifest || readIndexedPackageManifest;
+	const indexed = Buffer.from(indexReader(projectRoot, options.execGit));
+	const packagePath = path.join(projectRoot, 'package.json');
+	const stat = fs.lstatSync(packagePath);
+	if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('package.json must be a regular file.');
+	const current = fs.readFileSync(packagePath);
+	const version = readPinnedBunVersion(indexed);
+	if (readPinnedBunVersion(current) !== version) {
+		throw new Error('package.json Bun pin differs from the Git index; stage the intended manifest before updating workflow pins.');
+	}
+	return { version };
+}
+
+function deriveBunWorkflowUpdate(projectRoot, sourceHead, workflowPath, options = {}) {
+	const version = options.version || resolveBunVersionTarget(projectRoot, options).version;
+	const sourceReader = options.readSourceWorkflow || readSourceWorkflow;
+	const baseline = Buffer.from(sourceReader(projectRoot, sourceHead, workflowPath, options.execGit));
+	return {
+		path: workflowPath,
+		version,
+		baseline,
+		content: Buffer.from(renderBunWorkflowPin(workflowPath, baseline, version)),
+	};
+}
+
+function readRegularWorkflow(projectRoot, workflowPath) {
+	const fullPath = path.join(projectRoot, workflowPath);
+	const stat = fs.lstatSync(fullPath);
+	if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`${workflowPath} must be a regular file.`);
+	return fs.readFileSync(fullPath);
+}
+
+function snapshotFile(projectRoot, filePath) {
+	const fullPath = path.join(projectRoot, filePath);
+	try {
+		const stat = fs.lstatSync(fullPath);
+		if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`${filePath} must be a regular file.`);
+		return { existed: true, content: fs.readFileSync(fullPath) };
+	} catch (error) {
+		if (error.code === 'ENOENT') return { existed: false, content: null };
+		throw error;
+	}
+}
+
+function sameSnapshot(left, right) {
+	return left.existed === right.existed
+		&& (!left.existed || left.content.equals(right.content));
+}
+
+function recoverAttempt(update, projectRoot, protectedWriter, protectedRemover) {
+	try {
+		const current = snapshotFile(projectRoot, update.path);
+		if (sameSnapshot(current, update.original)) return { allowed: true, action: 'unchanged' };
+		if (!current.existed || !current.content.equals(update.content)) {
+			return { allowed: false, reason: 'File changed after the Bun pin write; concurrent content was preserved.' };
+		}
+		const recoveryOptions = {
+			...update.writeOptions,
+			operation: update.recoveryOperation,
+			expectedContent: update.content,
+		};
+		return update.original.existed
+			? protectedWriter(projectRoot, update.path, update.original.content, recoveryOptions)
+			: protectedRemover(projectRoot, update.path, recoveryOptions);
+	} catch (error) {
+		return { allowed: false, reason: error.message };
+	}
+}
+
+function recoverAttempts(attempts, projectRoot, protectedWriter, protectedRemover) {
+	const files = [...attempts].reverse().map(update => ({
+		path: update.path,
+		...recoverAttempt(update, projectRoot, protectedWriter, protectedRemover),
+	}));
+	return { allowed: files.every(file => file.allowed), files };
+}
+
+async function failedUpdate(error, results, attempts, authorizations, projectRoot, context, extra = {}) {
+	let authority;
+	try {
+		authority = await context.cancelAuthorizations(projectRoot, authorizations, { deps: context.kernelDeps });
+	} catch (cancelError) {
+		authority = { success: false, error: cancelError.message, results: [] };
+	}
+	const files = recoverAttempts(attempts, projectRoot, context.protectedWriter, context.protectedRemover);
+	return {
+		success: false,
+		error,
+		results,
+		recovery: {
+			allowed: authority.success && files.allowed,
+			authority,
+			files: files.files,
+		},
+		...extra,
+	};
+}
+
+async function applyWorkflowUpdate(projectRoot, update, context) {
+	const authorityRecord = {
+		actor: context.actor,
+		path: update.path,
+		sourceHead: context.sourceHead,
+		capabilityId: context.createCapabilityId(),
+	};
+	context.authorizations.push(authorityRecord);
+	let authorization;
+	try {
+		authorization = await context.issueAuthorization(projectRoot, {
+			actor: context.actor,
+			path: update.path,
+			sourceHead: context.sourceHead,
+			targetBunVersion: context.version,
+		}, { deps: context.kernelDeps, capabilityId: authorityRecord.capabilityId });
+	} catch (error) {
+		authorization = { success: false, error: error.message };
+	}
+	if (!authorization.success) {
+		return { success: false, error: `Could not authorize ${update.path}: ${authorization.error}` };
+	}
+	if (authorization.capabilityId !== authorityRecord.capabilityId) {
+		return { success: false, error: `Could not authorize ${update.path}: authority returned a different capability id.` };
+	}
+
+	const writeOptions = {
+		actor: context.actor,
+		operation: 'update_bun_workflow_pin',
+		viaForgeApi: true,
+		surface: 'workflows',
+		expectedContent: update.current,
+	};
+	context.attempts.push({
+		...update,
+		original: { existed: true, content: update.current },
+		writeOptions,
+		recoveryOperation: 'recover_bun_workflow_pin',
+	});
+
+	let write;
+	try {
+		write = context.protectedWriter(projectRoot, update.path, update.content, writeOptions);
+	} catch (error) {
+		return { success: false, error: error.message };
+	}
+	if (!write.allowed) return { success: false, error: write.reason };
+
+	let audit;
+	try {
+		audit = context.auditWriter(createProtectedStateAuditRecord({
+			actor: context.actor,
+			surface: 'workflows',
+			path: update.path,
+			content: update.content,
+			operation: 'update_bun_workflow_pin',
+			viaForgeApi: true,
+			sourceHead: context.sourceHead,
+		}), { cwd: projectRoot });
+	} catch (error) {
+		audit = { success: false, error: error.message };
+	}
+	if (!audit.success) return { success: false, error: `Could not record ${update.path}: ${audit.error}` };
+
+	let completion;
+	try {
+		completion = await context.completeAuthorization(projectRoot, {
+			actor: context.actor,
+			path: update.path,
+			sourceHead: context.sourceHead,
+			capabilityId: authorization.capabilityId,
+			targetBunVersion: context.version,
+		}, { deps: context.kernelDeps });
+	} catch (error) {
+		completion = { success: false, error: error.message };
+	}
+	if (!completion.success) return { success: false, error: `Could not complete ${update.path}: ${completion.error}` };
+
+	return { success: true, result: { path: update.path, write, authorization, completion } };
+}
+
+async function updateBunWorkflowPins(projectRoot, options = {}) {
+	const npmWorkflow = require('./npm-publish-workflow');
+	const { verifyExpectedHead } = npmWorkflow;
+	const head = verifyExpectedHead(projectRoot, options.expectedHead, options.resolveHead);
+	if (!head.success) return head;
+	const sourceHead = head.sourceHead;
+	const actor = options.actor || options.env?.FORGE_ACTOR || process.env.FORGE_ACTOR || process.env.USER || process.env.USERNAME || 'forge-release';
+
+	let updates;
+	let npmUpdate;
+	try {
+		const target = resolveBunVersionTarget(projectRoot, options);
+		updates = BUN_WORKFLOW_SPECS.map(spec => {
+			const update = deriveBunWorkflowUpdate(projectRoot, sourceHead, spec.path, { ...options, version: target.version });
+			const current = readRegularWorkflow(projectRoot, spec.path);
+			const indexReader = options.readIndexedWorkflow || readIndexedWorkflow;
+			const indexed = Buffer.from(indexReader(projectRoot, spec.path, options.execGit));
+			if (!current.equals(update.baseline) && !current.equals(update.content)) {
+				throw new Error(`${spec.path} has unrelated local edits; restore or commit them before updating Bun pins.`);
+			}
+			if (!indexed.equals(update.baseline) && !indexed.equals(update.content)) {
+				throw new Error(`${spec.path} has unrelated staged edits; restore or commit them before updating Bun pins.`);
+			}
+			return { ...update, current, indexed };
+		});
+		const npmPath = npmWorkflow.NPM_PUBLISH_WORKFLOW_PATH;
+		const sourceVersion = readPinnedBunVersion((options.readSourcePackageManifest || readSourcePackageManifest)(
+			projectRoot,
+			sourceHead,
+			options.execGit,
+		));
+		const npmBaseline = Buffer.from((options.readSourceNpmPublishWorkflow || npmWorkflow.readSourceNpmPublishWorkflow)(
+			projectRoot,
+			sourceHead,
+			options.execGit,
+		));
+		if (!npmBaseline.equals(Buffer.from(npmWorkflow.renderNpmPublishWorkflow(sourceVersion)))) {
+			throw new Error(`${npmPath} at ${sourceHead} differs from its canonical generator output.`);
+		}
+		const npmContent = Buffer.from(npmWorkflow.renderNpmPublishWorkflow(updates[0].version));
+		const npmOriginal = snapshotFile(projectRoot, npmPath);
+		const npmIndexed = Buffer.from((options.readIndexedNpmPublishWorkflow || npmWorkflow.readIndexedNpmPublishWorkflow)(
+			projectRoot,
+			options.execGit,
+		));
+		if (!npmOriginal.existed || (!npmOriginal.content.equals(npmBaseline) && !npmOriginal.content.equals(npmContent))) {
+			throw new Error(`${npmPath} has unrelated local edits; restore or commit them before updating Bun pins.`);
+		}
+		if (!npmIndexed.equals(npmBaseline) && !npmIndexed.equals(npmContent)) {
+			throw new Error(`${npmPath} has unrelated staged edits; restore or commit them before updating Bun pins.`);
+		}
+		npmUpdate = {
+			path: npmPath,
+			original: npmOriginal,
+			content: npmContent,
+			writeOptions: {
+				actor,
+				operation: 'generate_npm_workflow',
+				viaForgeApi: true,
+				surface: 'workflows',
+			},
+			recoveryOperation: 'recover_npm_workflow',
+		};
+	} catch (error) {
+		return { success: false, error: error.message };
+	}
+
+	const authority = require('./protected-state-authority');
+	const issueAuthorization = options.issueAuthorization || authority.issueBunWorkflowAuthorization;
+	const completeAuthorization = options.completeAuthorization || authority.completeBunWorkflowAuthorization;
+	const cancelAuthorizations = options.cancelAuthorizations || authority.cancelBunWorkflowBatchAuthorizations;
+	const protectedWriter = options.writeProtectedFile || writeProtectedFile;
+	const protectedRemover = options.removeProtectedFile || removeProtectedFile;
+	const auditWriter = options.recordProtectedStateAuditEvent || recordProtectedStateAuditEvent;
+	const results = [];
+	const attempts = [];
+	const authorizations = [];
+	const context = {
+		actor,
+		sourceHead,
+		version: updates[0].version,
+		kernelDeps: options.kernelDeps,
+		createCapabilityId: options.createCapabilityId || randomUUID,
+		issueAuthorization,
+		completeAuthorization,
+		cancelAuthorizations,
+		protectedWriter,
+		protectedRemover,
+		auditWriter,
+		attempts,
+		authorizations,
+	};
+	for (const update of updates) {
+		const applied = await applyWorkflowUpdate(projectRoot, update, context);
+		if (!applied.success) {
+			return failedUpdate(applied.error, results, attempts, authorizations, projectRoot, context);
+		}
+		results.push(applied.result);
+	}
+
+	const npmGenerator = options.generateNpmPublishWorkflow || npmWorkflow.generateNpmPublishWorkflow;
+	attempts.push(npmUpdate);
+	const npmAuthorization = {
+		actor,
+		path: npmUpdate.path,
+		sourceHead,
+		capabilityId: context.createCapabilityId(),
+	};
+	authorizations.push(npmAuthorization);
+	let npm;
+	try {
+		npm = await npmGenerator(projectRoot, {
+			actor,
+			env: options.env,
+			kernelDeps: options.kernelDeps,
+			expectedHead: sourceHead,
+			resolveHead: options.resolveHead,
+			bunVersion: updates[0].version,
+			targetBunVersion: updates[0].version,
+			capabilityId: npmAuthorization.capabilityId,
+			expectedSnapshot: npmUpdate.original,
+		});
+	} catch (error) {
+		return failedUpdate(error.message, results, attempts, authorizations, projectRoot, context);
+	}
+	if (!npm.success) {
+		return failedUpdate(npm.error, results, attempts, authorizations, projectRoot, context, { npm });
+	}
+
+	return {
+		success: true,
+		version: updates[0].version,
+		paths: [...results.map(result => result.path), npm.path],
+		results,
+		npm,
+	};
+}
+
+module.exports = {
+	BUN_WORKFLOW_SPECS,
+	readPinnedBunVersion,
+	renderBunWorkflowPin,
+	readSourceWorkflow,
+	readIndexedWorkflow,
+	readIndexedPackageManifest,
+	readSourcePackageManifest,
+	resolveBunVersionTarget,
+	resolveCurrentHead,
+	deriveBunWorkflowUpdate,
+	updateBunWorkflowPins,
+};

package/lib/capabilities/index.js

@@ -0,0 +1,9 @@
+'use strict';
+
+const model = require('./model');
+const probes = require('./probes');
+
+module.exports = {
+  ...model,
+  ...probes,
+};

package/lib/capabilities/model.js

@@ -0,0 +1,141 @@
+'use strict';
+
+const { createHash } = require('node:crypto');
+
+const RESULT_STATUSES = Object.freeze(['PASS', 'INCOMPLETE']);
+const AVAILABILITY_STATUSES = Object.freeze(['AVAILABLE', 'UNAVAILABLE']);
+const CAPABILITY_STATUSES = Object.freeze(['AVAILABLE', 'UNAVAILABLE', 'INCOMPLETE']);
+
+function assertEnum(value, allowed, field) {
+  if (!allowed.includes(value)) {
+    throw new TypeError(`${field} must be one of: ${allowed.join(', ')}`);
+  }
+}
+
+function assertOptionalString(value, field) {
+  if (value !== null && (typeof value !== 'string' || value.length === 0)) {
+    throw new TypeError(`${field} must be null or a non-empty string`);
+  }
+}
+
+function normalizeCapability(capability) {
+  if (!capability || typeof capability !== 'object' || Array.isArray(capability)) {
+    throw new TypeError('capability must be an object');
+  }
+  if (typeof capability.id !== 'string' || capability.id.length === 0) {
+    throw new TypeError('capability.id must be a non-empty string');
+  }
+  if (typeof capability.available !== 'boolean') {
+    throw new TypeError('capability.available must be a boolean');
+  }
+  assertEnum(capability.status, CAPABILITY_STATUSES, 'capability.status');
+  if (typeof capability.reason !== 'string' || capability.reason.length === 0) {
+    throw new TypeError('capability.reason must be a non-empty string');
+  }
+  if (typeof capability.probe_id !== 'string' || capability.probe_id.length === 0) {
+    throw new TypeError('capability.probe_id must be a non-empty string');
+  }
+  if (capability.available !== (capability.status === 'AVAILABLE')) {
+    throw new TypeError('capability.available must agree with capability.status');
+  }
+  return {
+    id: capability.id,
+    available: capability.available,
+    status: capability.status,
+    reason: capability.reason,
+    probe_id: capability.probe_id,
+  };
+}
+
+function compareIds(left, right) {
+  if (left.id < right.id) return -1;
+  if (left.id > right.id) return 1;
+  return 0;
+}
+
+function hashProjection(result) {
+  return {
+    schema_version: result.schema_version,
+    probe_revision: result.probe_revision,
+    harness_id: result.harness_id,
+    status: result.status,
+    availability: result.availability,
+    executable: {
+      command: result.executable.command,
+      identity: result.executable.identity,
+      version: result.executable.version,
+    },
+    capabilities: result.capabilities
+      .map(normalizeCapability)
+      .sort(compareIds),
+  };
+}
+
+function computeProbeResultHash(result) {
+  return createHash('sha256')
+    .update(JSON.stringify(hashProjection(result)), 'utf8')
+    .digest('hex');
+}
+
+function deepFreeze(value) {
+  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const child of Object.values(value)) deepFreeze(child);
+  }
+  return value;
+}
+
+function createProbeResult(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new TypeError('probe result input must be an object');
+  }
+  if (typeof input.harnessId !== 'string' || input.harnessId.length === 0) {
+    throw new TypeError('harnessId must be a non-empty string');
+  }
+  if (typeof input.probeRevision !== 'string' || input.probeRevision.length === 0) {
+    throw new TypeError('probeRevision must be a non-empty string');
+  }
+  assertEnum(input.status, RESULT_STATUSES, 'status');
+  assertEnum(input.availability, AVAILABILITY_STATUSES, 'availability');
+  if (!input.executable || typeof input.executable !== 'object' || Array.isArray(input.executable)) {
+    throw new TypeError('executable must be an object');
+  }
+  if (typeof input.executable.command !== 'string' || input.executable.command.length === 0) {
+    throw new TypeError('executable.command must be a non-empty string');
+  }
+  assertOptionalString(input.executable.identity, 'executable.identity');
+  assertOptionalString(input.executable.version, 'executable.version');
+  if (!Array.isArray(input.capabilities)) {
+    throw new TypeError('capabilities must be an array');
+  }
+  const observedAt = new Date(input.observedAt);
+  if (!Number.isFinite(observedAt.getTime())) {
+    throw new TypeError('observedAt must be a valid timestamp');
+  }
+
+  const result = {
+    schema_version: 1,
+    probe_revision: input.probeRevision,
+    harness_id: input.harnessId,
+    status: input.status,
+    availability: input.availability,
+    observed_at: observedAt.toISOString(),
+    executable: {
+      command: input.executable.command,
+      identity: input.executable.identity,
+      version: input.executable.version,
+    },
+    capabilities: input.capabilities.map(normalizeCapability)
+      .sort(compareIds),
+  };
+  result.result_hash = computeProbeResultHash(result);
+  return deepFreeze(result);
+}
+
+module.exports = {
+  AVAILABILITY_STATUSES,
+  CAPABILITY_STATUSES,
+  RESULT_STATUSES,
+  computeProbeResultHash,
+  createProbeResult,
+};