niceeval 0.13.3-canary.37 → 0.13.3

package/dist/record/family/assertions.cjs

@@ -1,6 +1,7 @@
 "use strict";
+const __niceevalDynamicImport = (specifier) => import(specifier);
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.assertionsRecordAttachment = exports.AssertionsAttachmentSchema = exports.AssertionSourceSitesSchema = exports.AssertionsEntriesSchema = exports.AssertionSourceSiteSchema = void 0;
+exports.assertionsRecordAttachment = exports.AssertionsAttachmentV1Schema = exports.AssertionsAttachmentSchema = exports.AssertionSourceSitesSchema = exports.AssertionsEntriesV1Schema = exports.AssertionsEntriesSchema = exports.AssertionSourceSiteSchema = void 0;
 exports.assertionsBlobRefs = assertionsBlobRefs;
 exports.assertionsAttachmentIntegrityIssues = assertionsAttachmentIntegrityIssues;
 exports.assertionsSourceSiteIntegrityIssues = assertionsSourceSiteIntegrityIssues;
@@ -34,10 +35,11 @@ exports.AssertionSourceSiteSchema = effect_1.Schema.Struct({
 const assertionSchemas = (0, codec_ts_1.createAssertionsRecordSchemas)(blob_ref_ts_1.RecordBlobRefSchema);
 /** Reuse the existing v1 entry schema inside the one direct attachment schema. */
 exports.AssertionsEntriesSchema = assertionSchemas.entries;
+exports.AssertionsEntriesV1Schema = assertionSchemas.historicalEntries;
 exports.AssertionSourceSitesSchema = effect_1.Schema.Array(exports.AssertionSourceSiteSchema);
 function hasNoLegacyAttachmentMaterial(document) {
     const materialIsAllowed = (material) => material.kind !== "record-attachment";
-    return document.entries.every((entry) => materialIsAllowed(entry.subject) && entry.evidence.every(materialIsAllowed));
+    return document.entries.every((entry) => materialIsAllowed(entry.materials.source) && entry.materials.evidence.every(materialIsAllowed));
 }
 function hasCanonicalSourceSites(payload) {
     const entryIds = new Set(payload.entries.map((entry) => entry.entryId));
@@ -94,6 +96,11 @@ exports.AssertionsAttachmentSchema = effect_1.Schema.Struct({
     identifier: "AssertionsSourceSites",
     description: "source sites join local entries with unique canonical source order",
 }));
+/** @internal Package-private historical wire codec, loaded only by maintenance. */
+exports.AssertionsAttachmentV1Schema = effect_1.Schema.Struct({
+    entries: effect_1.Schema.propertySignature(exports.AssertionsEntriesV1Schema).pipe(effect_1.Schema.fromKey("entries-data")),
+    sourceSites: effect_1.Schema.propertySignature(exports.AssertionSourceSitesSchema).pipe(effect_1.Schema.fromKey("source-sites-data")),
+});
 /** Complete closure projection for `niceeval.assertions`. */
 function assertionsBlobRefs(payload) {
     return (0, attachment_ts_1.assertionBlobRefs)(payload);
@@ -121,8 +128,8 @@ function assertionsAttachmentIntegrityIssues(payload, blobs) {
         }
     };
     for (const [index, entry] of payload.entries.entries()) {
-        validateMaterial(entry.subject, ["entries", String(index), "subject"]);
-        for (const [evidenceIndex, material] of entry.evidence.entries()) {
+        validateMaterial(entry.materials.source, ["entries", String(index), "materials", "source"]);
+        for (const [evidenceIndex, material] of entry.materials.evidence.entries()) {
             validateMaterial(material, ["entries", String(index), "evidence", String(evidenceIndex)]);
         }
     }
@@ -155,7 +162,7 @@ const AssertionsBlobBudget = Object.freeze({
 exports.assertionsRecordAttachment = (0, index_ts_1.defineRecordAttachment)({
     family: "niceeval.assertions",
     current: {
-        schemaVersion: 1,
+        schemaVersion: 2,
         owners: {
             attempt: {
                 schema: exports.AssertionsAttachmentSchema,
@@ -168,5 +175,9 @@ exports.assertionsRecordAttachment = (0, index_ts_1.defineRecordAttachment)({
             },
         },
     },
+    maintenance: () => __niceevalDynamicImport("./assertions-v1.cjs").then(({ assertionsV1Maintenance }) => assertionsV1Maintenance),
+    adjacentMigrationLinks: Object.freeze([
+        Object.freeze({ fromSchemaVersion: 1, toSchemaVersion: 2, rewritePayload: true }),
+    ]),
 });
 //# sourceMappingURL=assertions.cjs.map

package/dist/record/family/assertions.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"assertions.js","sourceRoot":"","sources":["assertions.ts"],"names":[],"mappings":";;;AAkHA,gDAEC;AAED,kFA+BC;AAMD,kFAYC;AAvKD,6CAAyC;AACzC,mCAAgC;AAChC,yEAA0E;AAC1E,+DAAwI;AACxI,2DAAqF;AACrF,uDAA4F;AAC5F,qDAAgE;AAChE,4DAAkF;AAClF,2CAAqF;AAErF,MAAM,yBAAyB,GAAG,eAAM,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAClH,MAAM,6BAA6B,GAAG,eAAM,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,qCAAyB;IAC/B,MAAM,EAAE,qCAAyB;CACpC,CAAC,CAAC;AACH;;;GAGG;AACU,QAAA,yBAAyB,GAAG,eAAM,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,iCAAsB;IAC/B,WAAW,EAAE,qCAAyB;IACtC,IAAI,EAAE,yBAAyB;IAC/B,YAAY,EAAE,mCAAkB;IAChC,MAAM,EAAE,mCAAkB;IAC1B,KAAK,EAAE,6BAA6B;IACpC,GAAG,EAAE,6BAA6B;CACrC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAA,wCAA6B,EAAC,iCAAmB,CAAC,CAAC;AAC5E,kFAAkF;AACrE,QAAA,uBAAuB,GAAG,gBAAgB,CAAC,OAAO,CAAC;AACnD,QAAA,0BAA0B,GAAG,eAAM,CAAC,KAAK,CAAC,iCAAyB,CAAC,CAAC;AAClF,SAAS,6BAA6B,CAAC,QAStC;IACG,MAAM,iBAAiB,GAAG,CAAC,QAE1B,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,mBAAmB,CAAC;IACrD,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAC1H,CAAC;AACD,SAAS,uBAAuB,CAAC,OAKhC;IACG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,QAA4B,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/D,OAAO,KAAK,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QACpF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,IAAI,GAAG;YACzC,OAAO,KAAK,CAAC;QACjB,QAAQ,GAAG,GAAG,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,SAAS,0BAA0B,CAAC,QAInC;IACG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3B,OAAO,KAAK,CAAC;QACjB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,SAAS,mCAAmC,CAAC,KAAc;IACvD,IAAI,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,OAAO,UAAU,KAAK,QAAQ;YACjC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,IAAI,uCAA4B,CAAC;IACxF,CAAC;IACD,MAAM,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD;;;GAGG;AACH,oFAAoF;AACvE,QAAA,0BAA0B,GAAG,eAAM,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,eAAM,CAAC,iBAAiB,CAAC,+BAAuB,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/F,WAAW,EAAE,eAAM,CAAC,iBAAiB,CAAC,kCAA0B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC9G,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE;IAC9C,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,6CAA6C;CAC7D,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE;IACnD,UAAU,EAAE,wBAAwB;IACpC,WAAW,EAAE,sCAAsC;CACtD,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE;IAC7C,UAAU,EAAE,sCAAsC;IAClD,WAAW,EAAE,yDAAyD;CACzE,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE;IACvC,UAAU,EAAE,uBAAuB;IACnC,WAAW,EAAE,oEAAoE;CACpF,CAAC,CAAC,CAAC;AAEJ,6DAA6D;AAC7D,SAAgB,kBAAkB,CAAC,OAA6B;IAC5D,OAAO,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AACD,+EAA+E;AAC/E,SAAgB,mCAAmC,CAAC,OAA6B,EAAE,KAGhF;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,CAA4B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAU,CAAC,CAAC,CAAC;IAC5G,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,gBAAgB,GAAG,CAAC,QAA4D,EAAE,IAAuB,EAAE,EAAE;QAC/G,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;YACxB,OAAO;QACX,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,IAAA,iCAAqB,EAAC,wCAAwC,EAAE;gBACxE,GAAG,IAAI;gBACP,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;aAC7C,CAAC,CAAC,CAAC;YACJ,OAAO;QACX,CAAC;QACD,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,IAAA,iCAAqB,EAAC,wCAAwC,EAAE;gBACxE,GAAG,IAAI;gBACP,QAAQ;aACX,CAAC,CAAC,CAAC;QACR,CAAC;IACL,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACvE,KAAK,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,gBAAgB,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9F,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AACD;;;;GAIG;AACH,SAAgB,mCAAmC,CAAC,OAA6B,EAAE,OAA0B;IACzG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAU,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI;YAClD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,IAAA,iCAAqB,EAAC,wCAAwC,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AACD,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,KAAK;IACnB,gBAAgB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAClC,iBAAiB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;CACtC,CAAC,CAAC;AACH,4EAA4E;AAC/D,QAAA,0BAA0B,GAAG,IAAA,iCAAsB,EAAC;IAC7D,MAAM,EAAE,qBAAqB;IAC7B,OAAO,EAAE;QACL,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE;YACJ,OAAO,EAAE;gBACL,MAAM,EAAE,kCAA0B;gBAClC,MAAM,EAAE,sCAA0B;gBAClC,KAAK,EAAE;oBACH,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,oBAAoB;oBAC5B,MAAM,EAAE,mCAAmC;iBAC9C;aACJ;SACJ;KACJ;CACJ,CAAC,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { Schema } from \"effect\";\nimport { assertionBlobRefs } from \"../../assertions/record/attachment.ts\";\nimport { AssertionEntryIdSchema, MAX_ASSERTION_DOCUMENT_BYTES, createAssertionsRecordSchemas, } from \"../../assertions/record/codec.ts\";\nimport { RecordBlobRefSchema, type RecordBlobRef, } from \"../attachment/blob-ref.ts\";\nimport { recordAttachmentIssue, type RecordAttachmentIssue } from \"../attachment/errors.ts\";\nimport { defineRecordAttachment } from \"../definition/index.ts\";\nimport { Sha256DigestSchema, SourceItemIdSchema, } from \"../codec/identifiers.ts\";\nimport { FixedAttachmentValueLimits, PositiveSafeIntegerSchema, } from \"./common.ts\";\nimport type { SourcesAttachment } from \"./sources.ts\";\nconst AssertionSourceRoleSchema = Schema.Literal(\"declaration\", \"threshold\", \"score\", \"gate\", \"optional\", \"stop\");\nconst AssertionSourcePositionSchema = Schema.Struct({\n    line: PositiveSafeIntegerSchema,\n    column: PositiveSafeIntegerSchema,\n});\n/**\n * A source site is a semantic join only. It names an item in the exact origin\n * Run Sources payload and never gains that payload's blob capability.\n */\nexport const AssertionSourceSiteSchema = Schema.Struct({\n    entryId: AssertionEntryIdSchema,\n    sourceOrder: PositiveSafeIntegerSchema,\n    role: AssertionSourceRoleSchema,\n    sourceItemId: SourceItemIdSchema,\n    sha256: Sha256DigestSchema,\n    start: AssertionSourcePositionSchema,\n    end: AssertionSourcePositionSchema,\n});\nexport type AssertionSourceSite = Schema.Schema.Type<typeof AssertionSourceSiteSchema>;\nconst assertionSchemas = createAssertionsRecordSchemas(RecordBlobRefSchema);\n/** Reuse the existing v1 entry schema inside the one direct attachment schema. */\nexport const AssertionsEntriesSchema = assertionSchemas.entries;\nexport const AssertionSourceSitesSchema = Schema.Array(AssertionSourceSiteSchema);\nfunction hasNoLegacyAttachmentMaterial(document: {\n    readonly entries: readonly {\n        readonly subject: {\n            readonly kind: string;\n        };\n        readonly evidence: readonly {\n            readonly kind: string;\n        }[];\n    }[];\n}): boolean {\n    const materialIsAllowed = (material: {\n        readonly kind: string;\n    }): boolean => material.kind !== \"record-attachment\";\n    return document.entries.every((entry) => materialIsAllowed(entry.subject) && entry.evidence.every(materialIsAllowed));\n}\nfunction hasCanonicalSourceSites(payload: {\n    readonly entries: readonly {\n        readonly entryId: string;\n    }[];\n    readonly sourceSites: readonly AssertionSourceSite[];\n}): boolean {\n    const entryIds = new Set(payload.entries.map((entry) => entry.entryId));\n    const seenOrders = new Set<number>();\n    let previous: string | undefined;\n    for (const site of payload.sourceSites) {\n        if (!entryIds.has(site.entryId) || seenOrders.has(site.sourceOrder))\n            return false;\n        seenOrders.add(site.sourceOrder);\n        const key = `${site.entryId}\\u0000${site.sourceOrder.toString().padStart(16, \"0\")}`;\n        if (previous !== undefined && previous >= key)\n            return false;\n        previous = key;\n    }\n    return true;\n}\nfunction hasUniqueAssertionEntryIds(document: {\n    readonly entries: readonly {\n        readonly entryId: string;\n    }[];\n}): boolean {\n    const entryIds = new Set<string>();\n    for (const entry of document.entries) {\n        if (entryIds.has(entry.entryId))\n            return false;\n        entryIds.add(entry.entryId);\n    }\n    return true;\n}\nfunction isAssertionsDocumentWithinSizeLimit(value: unknown): boolean {\n    try {\n        const serialized = JSON.stringify(value);\n        return typeof serialized === \"string\" &&\n            new TextEncoder().encode(serialized).byteLength <= MAX_ASSERTION_DOCUMENT_BYTES;\n    }\n    catch {\n        return false;\n    }\n}\n/**\n * `sourceSites` is embedded in the fixed Assertions payload. The former\n * `niceeval.assertion-source-sites/v1` family is not part of Record v1.\n */\n/** One direct current schema: Type fields and durable keys share all v1 filters. */\nexport const AssertionsAttachmentSchema = Schema.Struct({\n    entries: Schema.propertySignature(AssertionsEntriesSchema).pipe(Schema.fromKey(\"entries-data\")),\n    sourceSites: Schema.propertySignature(AssertionSourceSitesSchema).pipe(Schema.fromKey(\"source-sites-data\")),\n}).pipe(Schema.filter(hasUniqueAssertionEntryIds, {\n    identifier: \"AssertionsUniqueEntryIds\",\n    description: \"unique attachment-local assertion entry IDs\",\n}), Schema.filter(isAssertionsDocumentWithinSizeLimit, {\n    identifier: \"AssertionsDocumentSize\",\n    description: \"a JSON document no larger than 4 MiB\",\n}), Schema.filter(hasNoLegacyAttachmentMaterial, {\n    identifier: \"AssertionsNoLegacyAttachmentMaterial\",\n    description: \"Assertions do not reference retired attachment families\",\n}), Schema.filter(hasCanonicalSourceSites, {\n    identifier: \"AssertionsSourceSites\",\n    description: \"source sites join local entries with unique canonical source order\",\n}));\nexport type AssertionsAttachment = Schema.Schema.Type<typeof AssertionsAttachmentSchema>;\n/** Complete closure projection for `niceeval.assertions`. */\nexport function assertionsBlobRefs(payload: AssertionsAttachment): readonly RecordBlobRef[] {\n    return assertionBlobRefs(payload);\n}\n/** Binds every Assertions blob declaration to its exact materialized bytes. */\nexport function assertionsAttachmentIntegrityIssues(payload: AssertionsAttachment, blobs: readonly {\n    readonly ref: RecordBlobRef;\n    readonly bytes: Uint8Array;\n}[]): readonly RecordAttachmentIssue[] {\n    const bytesByRef = new Map<RecordBlobRef, Uint8Array>(blobs.map((blob) => [blob.ref, blob.bytes] as const));\n    const issues: RecordAttachmentIssue[] = [];\n    const validateMaterial = (material: AssertionsAttachment[\"entries\"][number][\"subject\"], path: readonly string[]) => {\n        if (material.kind !== \"blob\")\n            return;\n        const bytes = bytesByRef.get(material.ref);\n        if (bytes === undefined || bytes.byteLength !== material.byteLength) {\n            issues.push(recordAttachmentIssue(\"record-attachment-materialized-invalid\", [\n                ...path,\n                bytes === undefined ? \"ref\" : \"byteLength\",\n            ]));\n            return;\n        }\n        if (createHash(\"sha256\").update(bytes).digest(\"hex\") !== material.sha256) {\n            issues.push(recordAttachmentIssue(\"record-attachment-materialized-invalid\", [\n                ...path,\n                \"sha256\",\n            ]));\n        }\n    };\n    for (const [index, entry] of payload.entries.entries()) {\n        validateMaterial(entry.subject, [\"entries\", String(index), \"subject\"]);\n        for (const [evidenceIndex, material] of entry.evidence.entries()) {\n            validateMaterial(material, [\"entries\", String(index), \"evidence\", String(evidenceIndex)]);\n        }\n    }\n    return Object.freeze(issues);\n}\n/**\n * Host-only semantic join to the exact origin Sources manifest.  The row owns\n * neither source bytes nor a blob capability, so this check deliberately\n * compares only the explicit item identity, digest, and stored coordinates.\n */\nexport function assertionsSourceSiteIntegrityIssues(payload: AssertionsAttachment, sources: SourcesAttachment): readonly RecordAttachmentIssue[] {\n    const sourceById = new Map(sources.items.map((item) => [item.sourceItemId, item] as const));\n    const issues: RecordAttachmentIssue[] = [];\n    for (const [index, site] of payload.sourceSites.entries()) {\n        const source = sourceById.get(site.sourceItemId);\n        const startsAfterEnd = site.start.line > site.end.line ||\n            (site.start.line === site.end.line && site.start.column > site.end.column);\n        if (source === undefined || source.sha256 !== site.sha256 || startsAfterEnd) {\n            issues.push(recordAttachmentIssue(\"record-attachment-materialized-invalid\", [\"sourceSites\", String(index)]));\n        }\n    }\n    return Object.freeze(issues);\n}\nconst AssertionsBlobBudget = Object.freeze({\n    maximumBlobs: 20000,\n    maximumBlobBytes: 16 * 1024 * 1024,\n    maximumTotalBytes: 64 * 1024 * 1024,\n});\n/** The sole current declaration for the Attempt-owned Assertions family. */\nexport const assertionsRecordAttachment = defineRecordAttachment({\n    family: \"niceeval.assertions\",\n    current: {\n        schemaVersion: 1,\n        owners: {\n            attempt: {\n                schema: AssertionsAttachmentSchema,\n                limits: FixedAttachmentValueLimits,\n                blobs: {\n                    refs: assertionsBlobRefs,\n                    budget: AssertionsBlobBudget,\n                    verify: assertionsAttachmentIntegrityIssues,\n                },\n            },\n        },\n    },\n});\n"]}
+{"version":3,"file":"assertions.js","sourceRoot":"","sources":["assertions.ts"],"names":[],"mappings":";;;AA0HA,gDAEC;AAED,kFA+BC;AAMD,kFAYC;AA/KD,6CAAyC;AACzC,mCAAgC;AAChC,yEAA0E;AAC1E,+DAAwI;AACxI,2DAAqF;AACrF,uDAA4F;AAC5F,qDAAgE;AAChE,4DAAkF;AAClF,2CAAqF;AAErF,MAAM,yBAAyB,GAAG,eAAM,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAClH,MAAM,6BAA6B,GAAG,eAAM,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,qCAAyB;IAC/B,MAAM,EAAE,qCAAyB;CACpC,CAAC,CAAC;AACH;;;GAGG;AACU,QAAA,yBAAyB,GAAG,eAAM,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,iCAAsB;IAC/B,WAAW,EAAE,qCAAyB;IACtC,IAAI,EAAE,yBAAyB;IAC/B,YAAY,EAAE,mCAAkB;IAChC,MAAM,EAAE,mCAAkB;IAC1B,KAAK,EAAE,6BAA6B;IACpC,GAAG,EAAE,6BAA6B;CACrC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAA,wCAA6B,EAAC,iCAAmB,CAAC,CAAC;AAC5E,kFAAkF;AACrE,QAAA,uBAAuB,GAAG,gBAAgB,CAAC,OAAO,CAAC;AACnD,QAAA,yBAAyB,GAAG,gBAAgB,CAAC,iBAAiB,CAAC;AAC/D,QAAA,0BAA0B,GAAG,eAAM,CAAC,KAAK,CAAC,iCAAyB,CAAC,CAAC;AAClF,SAAS,6BAA6B,CAAC,QAWtC;IACG,MAAM,iBAAiB,GAAG,CAAC,QAE1B,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,mBAAmB,CAAC;IACrD,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAC7I,CAAC;AACD,SAAS,uBAAuB,CAAC,OAKhC;IACG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,QAA4B,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/D,OAAO,KAAK,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QACpF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,IAAI,GAAG;YACzC,OAAO,KAAK,CAAC;QACjB,QAAQ,GAAG,GAAG,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,SAAS,0BAA0B,CAAC,QAInC;IACG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3B,OAAO,KAAK,CAAC;QACjB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,SAAS,mCAAmC,CAAC,KAAc;IACvD,IAAI,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,OAAO,UAAU,KAAK,QAAQ;YACjC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,IAAI,uCAA4B,CAAC;IACxF,CAAC;IACD,MAAM,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD;;;GAGG;AACH,oFAAoF;AACvE,QAAA,0BAA0B,GAAG,eAAM,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,eAAM,CAAC,iBAAiB,CAAC,+BAAuB,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/F,WAAW,EAAE,eAAM,CAAC,iBAAiB,CAAC,kCAA0B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC9G,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE;IAC9C,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,6CAA6C;CAC7D,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE;IACnD,UAAU,EAAE,wBAAwB;IACpC,WAAW,EAAE,sCAAsC;CACtD,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE;IAC7C,UAAU,EAAE,sCAAsC;IAClD,WAAW,EAAE,yDAAyD;CACzE,CAAC,EAAE,eAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE;IACvC,UAAU,EAAE,uBAAuB;IACnC,WAAW,EAAE,oEAAoE;CACpF,CAAC,CAAC,CAAC;AACJ,mFAAmF;AACtE,QAAA,4BAA4B,GAAG,eAAM,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,eAAM,CAAC,iBAAiB,CAAC,iCAAyB,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACjG,WAAW,EAAE,eAAM,CAAC,iBAAiB,CAAC,kCAA0B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC9G,CAAC,CAAC;AAEH,6DAA6D;AAC7D,SAAgB,kBAAkB,CAAC,OAA6B;IAC5D,OAAO,IAAA,iCAAiB,EAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AACD,+EAA+E;AAC/E,SAAgB,mCAAmC,CAAC,OAA6B,EAAE,KAGhF;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,CAA4B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAU,CAAC,CAAC,CAAC;IAC5G,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,gBAAgB,GAAG,CAAC,QAAwE,EAAE,IAAuB,EAAE,EAAE;QAC3H,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;YACxB,OAAO;QACX,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,IAAA,iCAAqB,EAAC,wCAAwC,EAAE;gBACxE,GAAG,IAAI;gBACP,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;aAC7C,CAAC,CAAC,CAAC;YACJ,OAAO;QACX,CAAC;QACD,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,IAAA,iCAAqB,EAAC,wCAAwC,EAAE;gBACxE,GAAG,IAAI;gBACP,QAAQ;aACX,CAAC,CAAC,CAAC;QACR,CAAC;IACL,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5F,KAAK,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACzE,gBAAgB,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9F,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AACD;;;;GAIG;AACH,SAAgB,mCAAmC,CAAC,OAA6B,EAAE,OAA0B;IACzG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAU,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI;YAClD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,IAAA,iCAAqB,EAAC,wCAAwC,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AACD,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,KAAK;IACnB,gBAAgB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAClC,iBAAiB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;CACtC,CAAC,CAAC;AACH,4EAA4E;AAC/D,QAAA,0BAA0B,GAAG,IAAA,iCAAsB,EAAC;IAC7D,MAAM,EAAE,qBAAqB;IAC7B,OAAO,EAAE;QACL,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE;YACJ,OAAO,EAAE;gBACL,MAAM,EAAE,kCAA0B;gBAClC,MAAM,EAAE,sCAA0B;gBAClC,KAAK,EAAE;oBACH,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,oBAAoB;oBAC5B,MAAM,EAAE,mCAAmC;iBAC9C;aACJ;SACJ;KACJ;IACD,WAAW,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC;IAChI,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;KACpF,CAAC;CACL,CAAC,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { Schema } from \"effect\";\nimport { assertionBlobRefs } from \"../../assertions/record/attachment.ts\";\nimport { AssertionEntryIdSchema, MAX_ASSERTION_DOCUMENT_BYTES, createAssertionsRecordSchemas, } from \"../../assertions/record/codec.ts\";\nimport { RecordBlobRefSchema, type RecordBlobRef, } from \"../attachment/blob-ref.ts\";\nimport { recordAttachmentIssue, type RecordAttachmentIssue } from \"../attachment/errors.ts\";\nimport { defineRecordAttachment } from \"../definition/index.ts\";\nimport { Sha256DigestSchema, SourceItemIdSchema, } from \"../codec/identifiers.ts\";\nimport { FixedAttachmentValueLimits, PositiveSafeIntegerSchema, } from \"./common.ts\";\nimport type { SourcesAttachment } from \"./sources.ts\";\nconst AssertionSourceRoleSchema = Schema.Literal(\"declaration\", \"threshold\", \"score\", \"gate\", \"optional\", \"stop\");\nconst AssertionSourcePositionSchema = Schema.Struct({\n    line: PositiveSafeIntegerSchema,\n    column: PositiveSafeIntegerSchema,\n});\n/**\n * A source site is a semantic join only. It names an item in the exact origin\n * Run Sources payload and never gains that payload's blob capability.\n */\nexport const AssertionSourceSiteSchema = Schema.Struct({\n    entryId: AssertionEntryIdSchema,\n    sourceOrder: PositiveSafeIntegerSchema,\n    role: AssertionSourceRoleSchema,\n    sourceItemId: SourceItemIdSchema,\n    sha256: Sha256DigestSchema,\n    start: AssertionSourcePositionSchema,\n    end: AssertionSourcePositionSchema,\n});\nexport type AssertionSourceSite = Schema.Schema.Type<typeof AssertionSourceSiteSchema>;\nconst assertionSchemas = createAssertionsRecordSchemas(RecordBlobRefSchema);\n/** Reuse the existing v1 entry schema inside the one direct attachment schema. */\nexport const AssertionsEntriesSchema = assertionSchemas.entries;\nexport const AssertionsEntriesV1Schema = assertionSchemas.historicalEntries;\nexport const AssertionSourceSitesSchema = Schema.Array(AssertionSourceSiteSchema);\nfunction hasNoLegacyAttachmentMaterial(document: {\n    readonly entries: readonly {\n        readonly materials: {\n            readonly source: {\n                readonly kind: string;\n            };\n            readonly evidence: readonly {\n                readonly kind: string;\n            }[];\n        };\n    }[];\n}): boolean {\n    const materialIsAllowed = (material: {\n        readonly kind: string;\n    }): boolean => material.kind !== \"record-attachment\";\n    return document.entries.every((entry) => materialIsAllowed(entry.materials.source) && entry.materials.evidence.every(materialIsAllowed));\n}\nfunction hasCanonicalSourceSites(payload: {\n    readonly entries: readonly {\n        readonly entryId: string;\n    }[];\n    readonly sourceSites: readonly AssertionSourceSite[];\n}): boolean {\n    const entryIds = new Set(payload.entries.map((entry) => entry.entryId));\n    const seenOrders = new Set<number>();\n    let previous: string | undefined;\n    for (const site of payload.sourceSites) {\n        if (!entryIds.has(site.entryId) || seenOrders.has(site.sourceOrder))\n            return false;\n        seenOrders.add(site.sourceOrder);\n        const key = `${site.entryId}\\u0000${site.sourceOrder.toString().padStart(16, \"0\")}`;\n        if (previous !== undefined && previous >= key)\n            return false;\n        previous = key;\n    }\n    return true;\n}\nfunction hasUniqueAssertionEntryIds(document: {\n    readonly entries: readonly {\n        readonly entryId: string;\n    }[];\n}): boolean {\n    const entryIds = new Set<string>();\n    for (const entry of document.entries) {\n        if (entryIds.has(entry.entryId))\n            return false;\n        entryIds.add(entry.entryId);\n    }\n    return true;\n}\nfunction isAssertionsDocumentWithinSizeLimit(value: unknown): boolean {\n    try {\n        const serialized = JSON.stringify(value);\n        return typeof serialized === \"string\" &&\n            new TextEncoder().encode(serialized).byteLength <= MAX_ASSERTION_DOCUMENT_BYTES;\n    }\n    catch {\n        return false;\n    }\n}\n/**\n * `sourceSites` is embedded in the fixed Assertions payload. The former\n * `niceeval.assertion-source-sites/v1` family is not part of Record v1.\n */\n/** One direct current schema: Type fields and durable keys share all v1 filters. */\nexport const AssertionsAttachmentSchema = Schema.Struct({\n    entries: Schema.propertySignature(AssertionsEntriesSchema).pipe(Schema.fromKey(\"entries-data\")),\n    sourceSites: Schema.propertySignature(AssertionSourceSitesSchema).pipe(Schema.fromKey(\"source-sites-data\")),\n}).pipe(Schema.filter(hasUniqueAssertionEntryIds, {\n    identifier: \"AssertionsUniqueEntryIds\",\n    description: \"unique attachment-local assertion entry IDs\",\n}), Schema.filter(isAssertionsDocumentWithinSizeLimit, {\n    identifier: \"AssertionsDocumentSize\",\n    description: \"a JSON document no larger than 4 MiB\",\n}), Schema.filter(hasNoLegacyAttachmentMaterial, {\n    identifier: \"AssertionsNoLegacyAttachmentMaterial\",\n    description: \"Assertions do not reference retired attachment families\",\n}), Schema.filter(hasCanonicalSourceSites, {\n    identifier: \"AssertionsSourceSites\",\n    description: \"source sites join local entries with unique canonical source order\",\n}));\n/** @internal Package-private historical wire codec, loaded only by maintenance. */\nexport const AssertionsAttachmentV1Schema = Schema.Struct({\n    entries: Schema.propertySignature(AssertionsEntriesV1Schema).pipe(Schema.fromKey(\"entries-data\")),\n    sourceSites: Schema.propertySignature(AssertionSourceSitesSchema).pipe(Schema.fromKey(\"source-sites-data\")),\n});\nexport type AssertionsAttachment = Schema.Schema.Type<typeof AssertionsAttachmentSchema>;\n/** Complete closure projection for `niceeval.assertions`. */\nexport function assertionsBlobRefs(payload: AssertionsAttachment): readonly RecordBlobRef[] {\n    return assertionBlobRefs(payload);\n}\n/** Binds every Assertions blob declaration to its exact materialized bytes. */\nexport function assertionsAttachmentIntegrityIssues(payload: AssertionsAttachment, blobs: readonly {\n    readonly ref: RecordBlobRef;\n    readonly bytes: Uint8Array;\n}[]): readonly RecordAttachmentIssue[] {\n    const bytesByRef = new Map<RecordBlobRef, Uint8Array>(blobs.map((blob) => [blob.ref, blob.bytes] as const));\n    const issues: RecordAttachmentIssue[] = [];\n    const validateMaterial = (material: AssertionsAttachment[\"entries\"][number][\"materials\"][\"source\"], path: readonly string[]) => {\n        if (material.kind !== \"blob\")\n            return;\n        const bytes = bytesByRef.get(material.ref);\n        if (bytes === undefined || bytes.byteLength !== material.byteLength) {\n            issues.push(recordAttachmentIssue(\"record-attachment-materialized-invalid\", [\n                ...path,\n                bytes === undefined ? \"ref\" : \"byteLength\",\n            ]));\n            return;\n        }\n        if (createHash(\"sha256\").update(bytes).digest(\"hex\") !== material.sha256) {\n            issues.push(recordAttachmentIssue(\"record-attachment-materialized-invalid\", [\n                ...path,\n                \"sha256\",\n            ]));\n        }\n    };\n    for (const [index, entry] of payload.entries.entries()) {\n        validateMaterial(entry.materials.source, [\"entries\", String(index), \"materials\", \"source\"]);\n        for (const [evidenceIndex, material] of entry.materials.evidence.entries()) {\n            validateMaterial(material, [\"entries\", String(index), \"evidence\", String(evidenceIndex)]);\n        }\n    }\n    return Object.freeze(issues);\n}\n/**\n * Host-only semantic join to the exact origin Sources manifest.  The row owns\n * neither source bytes nor a blob capability, so this check deliberately\n * compares only the explicit item identity, digest, and stored coordinates.\n */\nexport function assertionsSourceSiteIntegrityIssues(payload: AssertionsAttachment, sources: SourcesAttachment): readonly RecordAttachmentIssue[] {\n    const sourceById = new Map(sources.items.map((item) => [item.sourceItemId, item] as const));\n    const issues: RecordAttachmentIssue[] = [];\n    for (const [index, site] of payload.sourceSites.entries()) {\n        const source = sourceById.get(site.sourceItemId);\n        const startsAfterEnd = site.start.line > site.end.line ||\n            (site.start.line === site.end.line && site.start.column > site.end.column);\n        if (source === undefined || source.sha256 !== site.sha256 || startsAfterEnd) {\n            issues.push(recordAttachmentIssue(\"record-attachment-materialized-invalid\", [\"sourceSites\", String(index)]));\n        }\n    }\n    return Object.freeze(issues);\n}\nconst AssertionsBlobBudget = Object.freeze({\n    maximumBlobs: 20000,\n    maximumBlobBytes: 16 * 1024 * 1024,\n    maximumTotalBytes: 64 * 1024 * 1024,\n});\n/** The sole current declaration for the Attempt-owned Assertions family. */\nexport const assertionsRecordAttachment = defineRecordAttachment({\n    family: \"niceeval.assertions\",\n    current: {\n        schemaVersion: 2,\n        owners: {\n            attempt: {\n                schema: AssertionsAttachmentSchema,\n                limits: FixedAttachmentValueLimits,\n                blobs: {\n                    refs: assertionsBlobRefs,\n                    budget: AssertionsBlobBudget,\n                    verify: assertionsAttachmentIntegrityIssues,\n                },\n            },\n        },\n    },\n    maintenance: () => __niceevalDynamicImport(\"./assertions-v1.cjs\").then(({ assertionsV1Maintenance }) => assertionsV1Maintenance),\n    adjacentMigrationLinks: Object.freeze([\n        Object.freeze({ fromSchemaVersion: 1, toSchemaVersion: 2, rewritePayload: true }),\n    ]),\n});\n"]}