intentdna 1.9.0 → 1.9.3

package/dist/runtime/structured-output-validator.d.ts

@@ -0,0 +1,44 @@
+import type { CanonicalJsonValue } from "./canonical-json.js";
+import type { ExecutableRunPlanPayload } from "./executable-run-plan.js";
+export type StructuredOutputSchema = {
+    readonly type: "null";
+} | {
+    readonly type: "boolean";
+} | {
+    readonly type: "number";
+    readonly enum?: readonly number[];
+} | {
+    readonly type: "string";
+    readonly enum?: readonly string[];
+} | {
+    readonly type: "array";
+    readonly items: StructuredOutputSchema;
+    readonly minItems?: number;
+    readonly maxItems?: number;
+} | {
+    readonly type: "object";
+    readonly properties: Readonly<Record<string, StructuredOutputSchema>>;
+    readonly required?: readonly string[];
+    readonly additionalProperties?: boolean;
+};
+export interface StructuredOutputSchemaRegistry {
+    readonly schemas: Readonly<Record<string, StructuredOutputSchema>>;
+}
+export declare const DEFAULT_STRUCTURED_OUTPUT_SCHEMA_REGISTRY: StructuredOutputSchemaRegistry;
+export type StructuredOutputValidationFailureCode = "output_not_declared" | "output_not_structured" | "schema_ref_mismatch" | "schema_ref_unsupported" | "schema_validation_failed";
+export type StructuredOutputValidationResult = {
+    readonly valid: true;
+} | {
+    readonly valid: false;
+    readonly code: StructuredOutputValidationFailureCode;
+    readonly path: string;
+    readonly message: string;
+};
+export interface ValidatePinnedStructuredOutputInput {
+    readonly plan: ExecutableRunPlanPayload;
+    readonly node_id: string;
+    readonly output_name: string;
+    readonly schema_ref: string | null;
+    readonly value: CanonicalJsonValue;
+}
+export declare function validatePinnedStructuredOutput(input: ValidatePinnedStructuredOutputInput, registry: StructuredOutputSchemaRegistry): StructuredOutputValidationResult;

package/dist/runtime/structured-output-validator.js

@@ -0,0 +1,171 @@
+export const DEFAULT_STRUCTURED_OUTPUT_SCHEMA_REGISTRY = {
+    schemas: {
+        "intentdna.controller.diagnosis-source.v1": {
+            type: "object",
+            properties: {
+                mode: { type: "string", enum: ["fresh", "legacy", "canonical"] },
+            },
+            required: ["mode"],
+        },
+        "intentdna.controller.diagnosis-origin.v1": {
+            type: "object",
+            properties: {
+                mode: { type: "string", enum: ["fresh", "legacy", "canonical"] },
+                source_node_id: { type: "string" },
+                source_result_id: { type: "string" },
+            },
+            required: ["mode", "source_node_id", "source_result_id"],
+        },
+        "intentdna.frw.diagnosis-review.v1": {
+            type: "object",
+            properties: {
+                verdict: { type: "string", enum: ["APPROVE", "REQUEST_REANALYSIS"] },
+                contract_valid: { type: "boolean" },
+                contract_artifact_reviewed: { type: "string" },
+                artifact_reviewed: { type: "string" },
+                contract_snapshot: { type: "object", properties: {} },
+                updated_at: { type: "string" },
+            },
+            required: [
+                "verdict",
+                "contract_valid",
+                "contract_artifact_reviewed",
+                "artifact_reviewed",
+                "contract_snapshot",
+                "updated_at",
+            ],
+        },
+        "intentdna.frw.fix-progress.v1": {
+            type: "object",
+            properties: {
+                verdict: {
+                    type: "string",
+                    enum: [
+                        "PASS",
+                        "CONTINUE",
+                        "REQUEST_CHANGES",
+                        "BLOCKED",
+                        "DIAGNOSIS_CONTRACT_INVALID",
+                        "PROVENANCE_INVALID",
+                    ],
+                },
+                "module": { type: "string" },
+                round: { type: "number" },
+                run_id: { type: "string" },
+                diagnosis_artifact: { type: "string" },
+                review_artifact: { type: "string" },
+                module_complete: { type: "boolean" },
+                diagnosis_invalid: { type: "boolean" },
+                next_round_focus: { type: "string" },
+                failure_reason: { type: "string" },
+                updated_at: { type: "string" },
+            },
+            required: [
+                "verdict",
+                "module",
+                "round",
+                "run_id",
+                "diagnosis_artifact",
+                "review_artifact",
+                "module_complete",
+                "diagnosis_invalid",
+                "next_round_focus",
+                "failure_reason",
+                "updated_at",
+            ],
+        },
+    },
+};
+function declaredOutput(plan, nodeId, outputName) {
+    const node = plan.nodes.find((candidate) => candidate.node_id === nodeId);
+    if (node?.kind === "worker") {
+        return node.packet_template.output_contract.find((output) => output.name === outputName);
+    }
+    if (node?.kind === "system") {
+        return node.output_contract?.find((output) => output.name === outputName);
+    }
+    return undefined;
+}
+function fail(code, path, message) {
+    return { valid: false, code, path, message };
+}
+function validateValue(value, schema, path) {
+    if (schema.type === "null") {
+        return value === null ? { valid: true } : fail("schema_validation_failed", path, "must be null");
+    }
+    if (schema.type === "boolean") {
+        return typeof value === "boolean" ? { valid: true } : fail("schema_validation_failed", path, "must be a boolean");
+    }
+    if (schema.type === "number") {
+        if (typeof value !== "number")
+            return fail("schema_validation_failed", path, "must be a number");
+        if (schema.enum !== undefined && !schema.enum.includes(value)) {
+            return fail("schema_validation_failed", path, `must be one of: ${schema.enum.join(", ")}`);
+        }
+        return { valid: true };
+    }
+    if (schema.type === "string") {
+        if (typeof value !== "string")
+            return fail("schema_validation_failed", path, "must be a string");
+        if (schema.enum !== undefined && !schema.enum.includes(value)) {
+            return fail("schema_validation_failed", path, `must be one of: ${schema.enum.join(", ")}`);
+        }
+        return { valid: true };
+    }
+    if (schema.type === "array") {
+        if (!Array.isArray(value))
+            return fail("schema_validation_failed", path, "must be an array");
+        if (schema.minItems !== undefined && value.length < schema.minItems) {
+            return fail("schema_validation_failed", path, `must contain at least ${schema.minItems} item(s)`);
+        }
+        if (schema.maxItems !== undefined && value.length > schema.maxItems) {
+            return fail("schema_validation_failed", path, `must contain at most ${schema.maxItems} item(s)`);
+        }
+        for (let index = 0; index < value.length; index += 1) {
+            const result = validateValue(value[index], schema.items, `${path}/${index}`);
+            if (!result.valid)
+                return result;
+        }
+        return { valid: true };
+    }
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return fail("schema_validation_failed", path, "must be an object");
+    }
+    for (const key of schema.required ?? []) {
+        if (!Object.prototype.hasOwnProperty.call(value, key)) {
+            return fail("schema_validation_failed", `${path}/${key}`, "is required");
+        }
+    }
+    for (const [key, child] of Object.entries(value)) {
+        const childSchema = schema.properties[key];
+        if (childSchema === undefined) {
+            if (schema.additionalProperties === false) {
+                return fail("schema_validation_failed", `${path}/${key}`, "is not allowed");
+            }
+            continue;
+        }
+        const result = validateValue(child, childSchema, `${path}/${key}`);
+        if (!result.valid)
+            return result;
+    }
+    return { valid: true };
+}
+export function validatePinnedStructuredOutput(input, registry) {
+    const output = declaredOutput(input.plan, input.node_id, input.output_name);
+    if (output === undefined) {
+        return fail("output_not_declared", "$.output_name", `output '${input.output_name}' is not declared by worker '${input.node_id}'`);
+    }
+    if (output.kind !== "structured") {
+        return fail("output_not_structured", "$.output_name", `output '${input.output_name}' is not structured`);
+    }
+    if (output.schema_ref !== input.schema_ref) {
+        return fail("schema_ref_mismatch", "$.schema_ref", `submitted schema_ref does not match pinned output contract '${String(output.schema_ref)}'`);
+    }
+    if (input.schema_ref === null)
+        return { valid: true };
+    const schema = registry.schemas[input.schema_ref];
+    if (schema === undefined) {
+        return fail("schema_ref_unsupported", "$.schema_ref", `no service-owned validator is registered for '${input.schema_ref}'`);
+    }
+    return validateValue(input.value, schema, "$.value");
+}

package/dist/runtime/verifier-command-binding.d.ts

@@ -0,0 +1,22 @@
+export declare const TRUSTED_FULL_VERIFIER_COMMAND_SCHEMA_VERSION = "intentdna.trusted_full_verifier_command.v1";
+export interface TrustedFullVerifierCommand {
+    readonly schema_version: typeof TRUSTED_FULL_VERIFIER_COMMAND_SCHEMA_VERSION;
+    readonly source: "compiled_plan";
+}
+export type VerifierCommandBindingResult = {
+    readonly bound: true;
+    readonly command: string;
+    readonly env: Readonly<Record<string, string>>;
+    readonly mode: "environment" | "trusted_full_command";
+} | {
+    readonly bound: false;
+    readonly code: "unresolved_template" | "unsafe_template_context" | "full_command_trust_required";
+    readonly variable: string | null;
+    readonly message: string;
+};
+export interface BindVerifierCommandInput {
+    readonly command_template: string;
+    readonly runtime_values: Readonly<Record<string, string>>;
+    readonly full_command_trust?: TrustedFullVerifierCommand;
+}
+export declare function bindVerifierCommand(input: BindVerifierCommandInput): VerifierCommandBindingResult;

package/dist/runtime/verifier-command-binding.js

@@ -0,0 +1,162 @@
+export const TRUSTED_FULL_VERIFIER_COMMAND_SCHEMA_VERSION = "intentdna.trusted_full_verifier_command.v1";
+function occurrences(template) {
+    const found = [];
+    for (const match of template.matchAll(/\{\{(\w+)\}\}/g)) {
+        found.push({ start: match.index, end: match.index + match[0].length, name: match[1] });
+    }
+    for (const match of template.matchAll(/(^|[^\\])(\$ARGUMENTS)/g)) {
+        const start = match.index + match[1].length;
+        found.push({ start, end: start + match[2].length, name: "ARGUMENTS" });
+    }
+    return found.sort((left, right) => left.start - right.start);
+}
+function wholeCommandVariable(template) {
+    const trimmed = template.trim();
+    const named = /^\{\{(\w+)\}\}$/.exec(trimmed);
+    if (named)
+        return named[1];
+    return trimmed === "$ARGUMENTS" ? "ARGUMENTS" : null;
+}
+function shellTemplateContext(template, offset) {
+    let quote = "unquoted";
+    let escaped = false;
+    const expansions = [];
+    for (let index = 0; index < offset; index += 1) {
+        const character = template[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (character === "\\" && quote !== "single") {
+            escaped = true;
+            continue;
+        }
+        if (character === "'" && quote === "unquoted") {
+            quote = "single";
+            continue;
+        }
+        if (character === "'" && quote === "single") {
+            quote = "unquoted";
+            continue;
+        }
+        if (character === "\"" && quote === "unquoted") {
+            quote = "double";
+            continue;
+        }
+        if (character === "\"" && quote === "double") {
+            quote = "unquoted";
+            continue;
+        }
+        if (character === "`" && quote !== "single") {
+            quote = quote === "backtick" ? "unquoted" : "backtick";
+            continue;
+        }
+        if (quote === "single" || quote === "backtick")
+            continue;
+        if (template.startsWith("$((", index)) {
+            expansions.push("arithmetic");
+            index += 2;
+            continue;
+        }
+        if (template.startsWith("$(", index)) {
+            expansions.push("command");
+            index += 1;
+            continue;
+        }
+        if (template.startsWith("${", index)) {
+            expansions.push("parameter");
+            index += 1;
+            continue;
+        }
+        if (character === "}" && expansions.at(-1) === "parameter") {
+            expansions.pop();
+            continue;
+        }
+        if (character === ")" && expansions.length > 0) {
+            if (expansions.at(-1) === "arithmetic" && template[index + 1] === ")")
+                index += 1;
+            expansions.pop();
+        }
+    }
+    return { quote, nestedExpansion: expansions.length > 0 };
+}
+function shellWords(prefix) {
+    return prefix
+        .trim()
+        .split(/\s+/u)
+        .filter(Boolean);
+}
+function isAssignmentWord(word) {
+    return /^[A-Za-z_][A-Za-z0-9_]*=/u.test(word);
+}
+function isSafeDataArgument(template, occurrence) {
+    const context = shellTemplateContext(template, occurrence.start);
+    if (context.nestedExpansion || context.quote === "single" || context.quote === "backtick") {
+        return false;
+    }
+    const before = template.slice(0, occurrence.start);
+    const after = template.slice(occurrence.end);
+    const wholeDoubleQuotedArgument = context.quote === "double"
+        && before.endsWith("\"")
+        && after.startsWith("\"");
+    if (!wholeDoubleQuotedArgument)
+        return false;
+    const commandPrefix = before.slice(0, -1).trimEnd();
+    if (!commandPrefix || /(?:^|[;&|()\n])\s*$/u.test(commandPrefix))
+        return false;
+    const segment = commandPrefix.split(/[;&|()\n]/u).at(-1) ?? "";
+    const words = shellWords(segment);
+    const commandIndex = words.findIndex((word) => !isAssignmentWord(word));
+    if (commandIndex < 0)
+        return false;
+    const commandWords = words.slice(commandIndex);
+    if (commandWords.length === 0)
+        return false;
+    const previous = words.at(-1);
+    const program = commandWords[0].split("/").at(-1);
+    if ([".", "command", "env", "eval", "exec", "source", "xargs"].includes(program))
+        return false;
+    if (["-c", "-e"].includes(previous)
+        && ["bash", "dash", "ksh", "node", "perl", "python", "python3", "sh", "zsh"].includes(program))
+        return false;
+    return true;
+}
+function environmentName(name, index) {
+    const normalized = name.replace(/[^A-Za-z0-9_]/g, "_").toUpperCase();
+    return `INTENTDNA_VERIFIER_${index}_${normalized}`;
+}
+export function bindVerifierCommand(input) {
+    const wholeVariable = wholeCommandVariable(input.command_template);
+    if (wholeVariable !== null) {
+        const value = input.runtime_values[wholeVariable];
+        if (value === undefined) {
+            return { bound: false, code: "unresolved_template", variable: wholeVariable, message: `Verifier command variable '${wholeVariable}' is unresolved` };
+        }
+        if (input.full_command_trust?.schema_version !== TRUSTED_FULL_VERIFIER_COMMAND_SCHEMA_VERSION
+            || input.full_command_trust.source !== "compiled_plan") {
+            return { bound: false, code: "full_command_trust_required", variable: wholeVariable, message: "Whole-command runtime templates require compiled-plan trust" };
+        }
+        return { bound: true, command: value, env: {}, mode: "trusted_full_command" };
+    }
+    const found = occurrences(input.command_template);
+    const env = {};
+    let command = "";
+    let cursor = 0;
+    for (let index = 0; index < found.length; index += 1) {
+        const occurrence = found[index];
+        const value = input.runtime_values[occurrence.name];
+        if (value === undefined) {
+            return { bound: false, code: "unresolved_template", variable: occurrence.name, message: `Verifier command variable '${occurrence.name}' is unresolved` };
+        }
+        if (!isSafeDataArgument(input.command_template, occurrence)) {
+            return { bound: false, code: "unsafe_template_context", variable: occurrence.name, message: `Verifier command variable '${occurrence.name}' is not in a proven shell data argument position` };
+        }
+        const envName = environmentName(occurrence.name, index);
+        env[envName] = value;
+        command += input.command_template.slice(cursor, occurrence.start);
+        command += `\${${envName}}`;
+        cursor = occurrence.end;
+    }
+    command += input.command_template.slice(cursor);
+    return { bound: true, command, env, mode: "environment" };
+}

package/dist/runtime/verifier.d.ts

@@ -17,6 +17,51 @@ export interface VerifierCheckResult {
     message?: string;
     timedOut?: boolean;
 }
+export interface VerifierCommandLaunchError {
+    readonly code: string;
+    readonly messageDigest: `sha256:${string}`;
+}
+export type VerifierCommandProcessOutcome = {
+    readonly kind: "exited";
+    readonly exitCode: number;
+    readonly signal: null;
+    readonly timedOut: false;
+    readonly launchError: null;
+} | {
+    readonly kind: "signaled";
+    readonly exitCode: null;
+    readonly signal: NodeJS.Signals;
+    readonly timedOut: false;
+    readonly launchError: null;
+} | {
+    readonly kind: "timed_out";
+    readonly exitCode: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly timedOut: true;
+    readonly launchError: null;
+} | {
+    readonly kind: "launch_error";
+    readonly exitCode: null;
+    readonly signal: null;
+    readonly timedOut: false;
+    readonly launchError: VerifierCommandLaunchError;
+};
+export interface VerifierCommandExecutionResult {
+    readonly outcome: VerifierCommandProcessOutcome;
+    readonly processTreeDrained: boolean;
+    readonly evidence?: string;
+    readonly startedAt: string;
+    readonly completedAt: string;
+    readonly stdoutDigest: `sha256:${string}`;
+    readonly stdoutBytes: number;
+    readonly stderrDigest: `sha256:${string}`;
+    readonly stderrBytes: number;
+}
+export declare function assertVerifierCommandExecutionResult(value: unknown): asserts value is VerifierCommandExecutionResult;
+export declare function verifierCommandExecutionPassed(execution: VerifierCommandExecutionResult): boolean;
+export declare function verifierCommandExecutionTimedOut(execution: VerifierCommandExecutionResult): boolean;
+export declare function verifierCommandExecutionExitCode(execution: VerifierCommandExecutionResult): number | null;
+export declare function verifierCommandExecutionSignal(execution: VerifierCommandExecutionResult): NodeJS.Signals | null;
 export declare function resolveVerifierTemplate(template: string, variables?: Record<string, string>): string;
 export declare function verifierTemplateVariableNames(template: string): string[];
 export declare function validateVerifierTemplateVariables(template: string, variables?: Record<string, string>, mode?: "command" | "path"): {
@@ -36,12 +81,7 @@ export declare function isBuiltinAssertAllowed(policy: VerifierCommandPolicy | u
 export declare function verifierAssertPolicyMessage(assertName: string): string;
 export declare function trimVerifierEvidence(raw: string | undefined): string | undefined;
 export declare function summarizeCommandEvidence(stdout: string, stderr: string): string | undefined;
-export declare function execVerifierCommand(projectDir: string, command: string, timeoutMs?: number, env?: NodeJS.ProcessEnv): Promise<{
-    passed: boolean;
-    timedOut: boolean;
-    exitCode?: number;
-    evidence?: string;
-}>;
+export declare function execVerifierCommand(projectDir: string, command: string, timeoutMs?: number, env?: Readonly<Record<string, string>>, now?: () => Date): Promise<VerifierCommandExecutionResult>;
 export declare function resolveVerifierTarget(projectDir: string, targetPath: string): Promise<string | null>;
 export declare function toProjectRelativePath(projectDir: string, filePath: string): Promise<string>;
 export declare function getCompletionCheckFields(completion: CompletionCheck): string[];