oh-my-super-agent 0.1.0

package/dist/src/trust/assessment.js

@@ -0,0 +1,124 @@
+const RUN_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+const DIGEST_PATTERN = /^[0-9a-f]{64}$/;
+export const TRUST_MINIMUM_MATCHING_RUNS = 20;
+export const TRUST_REQUIRED_PASS_RATE_BASIS_POINTS = 9_500;
+export function assessTrust(value) {
+    const input = parseAssessmentInput(value);
+    let matchingRuns = 0;
+    let passedRuns = 0;
+    for (const run of input.runs) {
+        if (run.policy_version !== input.policy_version
+            || run.policy_digest !== input.policy_digest
+            || run.gate_digest !== input.gate_digest) {
+            continue;
+        }
+        matchingRuns += 1;
+        if (run.deterministic_passed)
+            passedRuns += 1;
+    }
+    const passRateBasisPoints = matchingRuns === 0
+        ? 0
+        : Math.floor((passedRuns * 10_000) / matchingRuns);
+    const eligibleForReview = matchingRuns >= TRUST_MINIMUM_MATCHING_RUNS
+        && passedRuns * 10_000 >= matchingRuns * TRUST_REQUIRED_PASS_RATE_BASIS_POINTS;
+    return Object.freeze({
+        status: eligibleForReview ? "eligible_for_review" : "manual",
+        matching_runs: matchingRuns,
+        passed_runs: passedRuns,
+        pass_rate_basis_points: passRateBasisPoints,
+        minimum_matching_runs: TRUST_MINIMUM_MATCHING_RUNS,
+        required_pass_rate_basis_points: TRUST_REQUIRED_PASS_RATE_BASIS_POINTS,
+    });
+}
+function parseAssessmentInput(value) {
+    assertExactJsonObject(value, ["policy_version", "policy_digest", "gate_digest", "runs"], "trust assessment input");
+    const identity = parseIdentity(value, "trust assessment input");
+    assertExactJsonArray(value.runs, "trust assessment input runs");
+    const runIds = new Set();
+    const runs = value.runs.map((run, index) => {
+        const parsed = parseRunSummary(run, `trust assessment input run ${index + 1}`);
+        if (runIds.has(parsed.run_id))
+            throw new Error(`duplicate trust run id: ${parsed.run_id}`);
+        runIds.add(parsed.run_id);
+        return parsed;
+    });
+    return {
+        ...identity,
+        runs,
+    };
+}
+function parseRunSummary(value, label) {
+    assertExactJsonObject(value, ["run_id", "policy_version", "policy_digest", "gate_digest", "deterministic_passed"], label);
+    if (typeof value.run_id !== "string" || !RUN_ID_PATTERN.test(value.run_id)) {
+        throw new Error(`${label} run_id is invalid`);
+    }
+    if (typeof value.deterministic_passed !== "boolean") {
+        throw new Error(`${label} deterministic_passed must be a boolean`);
+    }
+    return {
+        run_id: value.run_id,
+        ...parseIdentity(value, label),
+        deterministic_passed: value.deterministic_passed,
+    };
+}
+function parseIdentity(value, label) {
+    if (!Number.isSafeInteger(value.policy_version) || value.policy_version < 1) {
+        throw new Error(`${label} policy_version must be a positive integer`);
+    }
+    if (typeof value.policy_digest !== "string" || !DIGEST_PATTERN.test(value.policy_digest)) {
+        throw new Error(`${label} policy_digest is invalid`);
+    }
+    if (typeof value.gate_digest !== "string" || !DIGEST_PATTERN.test(value.gate_digest)) {
+        throw new Error(`${label} gate_digest is invalid`);
+    }
+    return {
+        policy_version: value.policy_version,
+        policy_digest: value.policy_digest,
+        gate_digest: value.gate_digest,
+    };
+}
+function assertExactJsonObject(value, keys, label) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${label} must be an object`);
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new Error(`${label} must be a plain JSON object`);
+    }
+    if (Object.getOwnPropertySymbols(value).length !== 0) {
+        throw new Error(`${label} must not contain symbol properties`);
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const expected = new Set(keys);
+    for (const key of keys) {
+        const descriptor = descriptors[key];
+        if (!descriptor)
+            throw new Error(`${label} is missing ${key}`);
+        if (!("value" in descriptor) || !descriptor.enumerable) {
+            throw new Error(`${label} ${key} must be a JSON data property`);
+        }
+    }
+    for (const key of Object.keys(descriptors)) {
+        if (!expected.has(key))
+            throw new Error(`${label} has unexpected property: ${key}`);
+    }
+}
+function assertExactJsonArray(value, label) {
+    if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) {
+        throw new Error(`${label} must be a JSON array`);
+    }
+    if (Object.getOwnPropertySymbols(value).length !== 0) {
+        throw new Error(`${label} must not contain symbol properties`);
+    }
+    const names = Object.getOwnPropertyNames(value);
+    if (names.length !== value.length + 1 || !names.includes("length")) {
+        throw new Error(`${label} must not be sparse or contain extra properties`);
+    }
+    for (let index = 0; index < value.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+            throw new Error(`${label} must not be sparse or contain non-data entries`);
+        }
+    }
+}
+//# sourceMappingURL=assessment.js.map

package/dist/src/trust/assessment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assessment.js","sourceRoot":"","sources":["../../../src/trust/assessment.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG,wCAAwC,CAAC;AAChE,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,qCAAqC,GAAG,KAAK,CAAC;AA4B3D,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IACE,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;eACxC,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;eACzC,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EACxC,CAAC;YACD,SAAS;QACX,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,oBAAoB;YAAE,UAAU,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,mBAAmB,GAAG,YAAY,KAAK,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC;IACrD,MAAM,iBAAiB,GAAG,YAAY,IAAI,2BAA2B;WAChE,UAAU,GAAG,MAAM,IAAI,YAAY,GAAG,qCAAqC,CAAC;IAEjF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ;QAC5D,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,UAAU;QACvB,sBAAsB,EAAE,mBAAmB;QAC3C,qBAAqB,EAAE,2BAA2B;QAClD,+BAA+B,EAAE,qCAAqC;KACvE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,qBAAqB,CAAC,KAAK,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACnH,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAChE,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,8BAA8B,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,QAAQ;QACX,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,qBAAqB,CACnB,KAAK,EACL,CAAC,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,sBAAsB,CAAC,EACpF,KAAK,CACN,CAAC;IACF,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B,EAAE,KAAa;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,IAAK,KAAK,CAAC,cAAyB,GAAG,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4CAA4C,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,cAAwB;QAC9C,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,IAAuB,EACvB,KAAa;IAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,GAAG,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,GAAG,+BAA+B,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iDAAiD,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iDAAiD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/trust/runs.d.ts

@@ -0,0 +1,13 @@
+import { type EvidenceReference, type EvidenceStore, type EvidenceWriteResult } from "../evidence/store.js";
+import { type TicketMaterializer } from "../tickets/materializer.js";
+export interface TrustPolicyIdentity {
+    readonly policy_version: number;
+    readonly policy_digest: string;
+}
+export interface RecordTrustRunOptions {
+    evidenceStore: EvidenceStore;
+    deterministicEvidence: EvidenceReference;
+    ticketMaterializer: TicketMaterializer;
+}
+export declare function recordTrustRun(options: RecordTrustRunOptions): EvidenceWriteResult;
+export declare function loadTrackedTrustPolicyIdentity(packageRoot?: string): Readonly<TrustPolicyIdentity>;

package/dist/src/trust/runs.js

@@ -0,0 +1,46 @@
+import { loadTrackedRolePolicyGate } from "../domain/role-policy.js";
+import { readDeterministicVerdict } from "../evidence/verdict.js";
+import { assertEvidenceStore, writeTicketBoundEvidence, } from "../evidence/store.js";
+import { findPackageRoot } from "../package-root.js";
+import { createStableId } from "../runtime/stable-id.js";
+import { assertTicketMaterializer, } from "../tickets/materializer.js";
+export function recordTrustRun(options) {
+    assertEvidenceStore(options.evidenceStore);
+    assertTicketMaterializer(options.ticketMaterializer);
+    const verdict = readDeterministicVerdict(options);
+    if (verdict.certification !== "live") {
+        throw new Error("non-certifying deterministic evidence cannot create canonical trust evidence");
+    }
+    const evidenceId = createStableId("trust-run", verdict.deterministic_evidence.evidence_id, verdict.deterministic_evidence.sha256);
+    return writeTicketBoundEvidence({
+        evidenceStore: options.evidenceStore,
+        ticketMaterializer: options.ticketMaterializer,
+        record: {
+            schema_version: 1,
+            evidence_id: evidenceId,
+            evidence_kind: "trust-run",
+            ticket_id: verdict.ticket_id,
+            producer_role: "oms.system",
+            created_at: verdict.created_at,
+            payload: {
+                schema_version: 1,
+                run_id: evidenceId,
+                ticket_id: verdict.ticket_id,
+                deterministic_evidence: verdict.deterministic_evidence,
+                attempt: verdict.attempt,
+                deterministic_passed: verdict.passed,
+                policy_version: verdict.policy_version,
+                policy_digest: verdict.policy_digest,
+                gate_digest: verdict.gate_digest,
+            },
+        },
+    });
+}
+export function loadTrackedTrustPolicyIdentity(packageRoot = findPackageRoot()) {
+    const policy = loadTrackedRolePolicyGate(packageRoot);
+    return Object.freeze({
+        policy_version: policy.version,
+        policy_digest: policy.digest,
+    });
+}
+//# sourceMappingURL=runs.js.map

package/dist/src/trust/runs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../../src/trust/runs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EACL,mBAAmB,EAInB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EACL,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AAapC,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,wBAAwB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,UAAU,GAAG,cAAc,CAC/B,WAAW,EACX,OAAO,CAAC,sBAAsB,CAAC,WAAW,EAC1C,OAAO,CAAC,sBAAsB,CAAC,MAAM,CACtC,CAAC;IAEF,OAAO,wBAAwB,CAAC;QAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,MAAM,EAAE;YACN,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,WAAW;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE;gBACP,cAAc,EAAE,CAAC;gBACjB,MAAM,EAAE,UAAU;gBAClB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;gBACtD,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,oBAAoB,EAAE,OAAO,CAAC,MAAM;gBACpC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,WAAW,GAAG,eAAe,EAAE;IAC5E,MAAM,MAAM,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC,OAAO;QAC9B,aAAa,EAAE,MAAM,CAAC,MAAM;KAC7B,CAAC,CAAC;AACL,CAAC"}

package/dist/src/types.d.ts

@@ -0,0 +1,6 @@
+export interface CliResult {
+    ok: boolean;
+    exitCode: number;
+    message?: string;
+    output?: unknown;
+}

package/dist/src/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}

package/dist/src/utils/fs.d.ts

@@ -0,0 +1,13 @@
+import { lstatSync } from "node:fs";
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function readJsonFile(path: string): unknown;
+export declare function readJsonFileNoFollow(path: string, maxBytes?: number): unknown;
+export declare function lstatIfExists(path: string): ReturnType<typeof lstatSync> | undefined;
+export declare function validateExistingDirectory(path: string, label: string): string;
+export declare function canonicalizePath(input: string, cwd?: string): string;
+export declare function writeFileAtomic(destination: string, content: string, requestedMode?: number): void;
+export declare function writeFileAtomicNoReplace(destination: string, content: string, requestedMode?: number): void;
+export declare function writeJsonAtomic(destination: string, value: unknown): void;
+export declare function writeJsonAtomicNoReplace(destination: string, value: unknown): void;
+export declare function fsyncDirectory(path: string): void;
+export declare function errorMessage(error: unknown): string;

package/dist/src/utils/fs.js

@@ -0,0 +1,188 @@
+import { chmodSync, closeSync, constants, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { basename, dirname, resolve } from "node:path";
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function readJsonFile(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        throw new Error(`unable to read JSON file ${path}: ${errorMessage(error)}`);
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`invalid JSON in ${path}: ${errorMessage(error)}`);
+    }
+}
+export function readJsonFileNoFollow(path, maxBytes) {
+    let descriptor;
+    try {
+        const before = lstatSync(path);
+        if (before.isSymbolicLink() || !before.isFile()) {
+            throw new Error("path is not a regular file");
+        }
+        const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
+        descriptor = openSync(path, constants.O_RDONLY | noFollow);
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino) {
+            throw new Error("path changed while opening");
+        }
+        if (maxBytes !== undefined && (!Number.isSafeInteger(maxBytes) || maxBytes < 1)) {
+            throw new Error("maxBytes must be a positive integer");
+        }
+        if (maxBytes !== undefined && opened.size > maxBytes)
+            throw new Error(`file exceeds ${maxBytes} bytes`);
+        const raw = readFileSync(descriptor, "utf8");
+        if (maxBytes !== undefined && Buffer.byteLength(raw, "utf8") > maxBytes) {
+            throw new Error(`file exceeds ${maxBytes} bytes`);
+        }
+        closeSync(descriptor);
+        descriptor = undefined;
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        throw new Error(`unable to safely read JSON file ${path}: ${errorMessage(error)}`);
+    }
+}
+export function lstatIfExists(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (isErrorCode(error, "ENOENT"))
+            return undefined;
+        throw error;
+    }
+}
+export function validateExistingDirectory(path, label) {
+    const absolute = resolve(path);
+    let entry;
+    try {
+        entry = lstatSync(absolute);
+    }
+    catch (error) {
+        throw new Error(`${label} does not exist: ${absolute}: ${errorMessage(error)}`);
+    }
+    if (entry.isSymbolicLink())
+        throw new Error(`${label} must not be a symbolic link: ${absolute}`);
+    if (!entry.isDirectory())
+        throw new Error(`${label} is not a directory: ${absolute}`);
+    const real = realpathSync.native(absolute);
+    const canonical = lstatSync(real);
+    if (!canonical.isDirectory() || canonical.dev !== entry.dev || canonical.ino !== entry.ino) {
+        throw new Error(`${label} changed while resolving: ${absolute}`);
+    }
+    return real;
+}
+export function canonicalizePath(input, cwd = process.cwd()) {
+    const absolute = resolve(cwd, input);
+    let existing = absolute;
+    const missingSegments = [];
+    while (!existsSync(existing)) {
+        const parent = dirname(existing);
+        if (parent === existing)
+            break;
+        missingSegments.unshift(basename(existing));
+        existing = parent;
+    }
+    const canonicalBase = existsSync(existing) ? realpathSync.native(existing) : existing;
+    return resolve(canonicalBase, ...missingSegments);
+}
+export function writeFileAtomic(destination, content, requestedMode = 0o600) {
+    mkdirSync(dirname(destination), { recursive: true });
+    const destinationEntry = lstatIfExists(destination);
+    if (destinationEntry?.isSymbolicLink()) {
+        throw new Error(`refusing to replace symbolic link: ${destination}`);
+    }
+    const mode = destinationEntry ? statSync(destination).mode & 0o777 : requestedMode;
+    const temporary = `${destination}.tmp.${process.pid}.${randomUUID()}`;
+    let descriptor;
+    try {
+        descriptor = openSync(temporary, "wx", mode);
+        writeFileSync(descriptor, content, "utf8");
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        chmodSync(temporary, mode);
+        renameSync(temporary, destination);
+        fsyncDirectory(dirname(destination));
+    }
+    catch (error) {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        if (lstatIfExists(temporary))
+            unlinkSync(temporary);
+        throw error;
+    }
+}
+export function writeFileAtomicNoReplace(destination, content, requestedMode = 0o600) {
+    const parent = validateExistingDirectory(dirname(destination), "destination directory");
+    if (parent !== dirname(destination))
+        throw new Error(`destination directory is not canonical: ${dirname(destination)}`);
+    const temporary = `${destination}.tmp.${process.pid}.${randomUUID()}`;
+    let descriptor;
+    let linked = false;
+    try {
+        descriptor = openSync(temporary, "wx", requestedMode);
+        writeFileSync(descriptor, content, "utf8");
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        chmodSync(temporary, requestedMode);
+        linkSync(temporary, destination);
+        linked = true;
+        fsyncDirectory(parent);
+        unlinkSync(temporary);
+        fsyncDirectory(parent);
+    }
+    catch (error) {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        if (lstatIfExists(temporary))
+            unlinkSync(temporary);
+        if (linked && !lstatIfExists(destination)) {
+            throw new Error(`atomic no-replace destination disappeared: ${destination}`);
+        }
+        throw error;
+    }
+}
+export function writeJsonAtomic(destination, value) {
+    writeFileAtomic(destination, `${JSON.stringify(value, null, 2)}\n`, 0o600);
+}
+export function writeJsonAtomicNoReplace(destination, value) {
+    writeFileAtomicNoReplace(destination, `${JSON.stringify(value, null, 2)}\n`, 0o600);
+}
+export function fsyncDirectory(path) {
+    let descriptor;
+    try {
+        descriptor = openSync(path, constants.O_RDONLY);
+        fsyncSync(descriptor);
+    }
+    catch (error) {
+        if (!isUnsupportedDirectorySync(error))
+            throw error;
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isErrorCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function isUnsupportedDirectorySync(error) {
+    if (typeof error !== "object" || error === null || !("code" in error))
+        return false;
+    return ["EINVAL", "ENOTSUP", "EISDIR", "EBADF", "EPERM"].includes(String(error.code));
+}
+//# sourceMappingURL=fs.js.map

package/dist/src/utils/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/utils/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEvD,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,QAAiB;IAClE,IAAI,UAA8B,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,QAAQ,CAAC,CAAC;QAExG,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,UAAU,GAAG,SAAS,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACnD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,KAAa;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAmC,CAAC;IAExC,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,QAAQ,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM;QAC/B,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtF,OAAO,OAAO,CAAC,aAAa,EAAE,GAAG,eAAe,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,OAAe,EAAE,aAAa,GAAG,KAAK;IACzF,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,gBAAgB,EAAE,cAAc,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IACnF,MAAM,SAAS,GAAG,GAAG,WAAW,QAAQ,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;IACtE,IAAI,UAA8B,CAAC;IAEnC,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7C,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,UAAU,GAAG,SAAS,CAAC;QACvB,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3B,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,aAAa,CAAC,SAAS,CAAC;YAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,WAAmB,EAAE,OAAe,EAAE,aAAa,GAAG,KAAK;IAClG,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACxF,IAAI,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACxH,MAAM,SAAS,GAAG,GAAG,WAAW,QAAQ,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,CAAC;IACtE,IAAI,UAA8B,CAAC;IACnC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACtD,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3C,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,UAAU,GAAG,SAAS,CAAC;QACvB,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACjC,MAAM,GAAG,IAAI,CAAC;QACd,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,cAAc,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,aAAa,CAAC,SAAS,CAAC;YAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,WAAW,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,KAAc;IACjE,eAAe,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,WAAmB,EAAE,KAAc;IAC1E,wBAAwB,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChD,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;IACtD,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC/F,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC"}

package/dist/src/verification/authority.d.ts

@@ -0,0 +1,28 @@
+import { type EvidenceRecord, type EvidenceReference, type EvidenceStore, type EvidenceWriteResult } from "../evidence/store.js";
+import { type ProtectedVerificationBinding, type WorktreeVerificationProof } from "./protected-runner.js";
+import { type ProtectedGradeSource } from "./grade-source.js";
+import type { VerificationResult } from "./runner.js";
+declare const PROTECTED_VERIFICATION_AUTHORITY: unique symbol;
+export interface ProtectedVerificationOutcome {
+    readonly status: "created" | "replayed";
+    readonly ref: EvidenceReference;
+    readonly record: EvidenceRecord;
+    readonly verification: VerificationResult;
+    readonly preflight: WorktreeVerificationProof;
+    readonly postflight: WorktreeVerificationProof;
+}
+export interface ProtectedVerificationAuthority {
+    readonly [PROTECTED_VERIFICATION_AUTHORITY]: true;
+    readonly policyVersion: number;
+    readonly policyDigest: string;
+    readonly planDigest: string;
+    verify(subject: ProtectedVerificationBinding): ProtectedVerificationOutcome;
+    writeGrade(record: EvidenceRecord, source: ProtectedGradeSource): EvidenceWriteResult;
+}
+export declare function createProtectedVerificationAuthority(options: {
+    packageRoot: string;
+    configRoot: string;
+    evidenceStore: EvidenceStore;
+}): ProtectedVerificationAuthority;
+export declare function assertProtectedVerificationAuthority(value: unknown): asserts value is ProtectedVerificationAuthority;
+export {};

package/dist/src/verification/authority.js

@@ -0,0 +1,153 @@
+import { assertTrackedRolePolicyGate, loadTrackedRolePolicyGate, } from "../domain/role-policy.js";
+import { assertEvidenceStore, createProtectedResultGateEvidenceWriter, } from "../evidence/store.js";
+import { createStableId } from "../runtime/stable-id.js";
+import { validateExistingDirectory } from "../utils/fs.js";
+import { freezeTrackedVerificationPlan } from "./plan.js";
+import { captureProtectedVerificationBinding, probeProtectedVerificationWorktree, runProtectedVerification, } from "./protected-runner.js";
+import { captureProtectedGradeSource, } from "./grade-source.js";
+const PROTECTED_VERIFICATION_AUTHORITY = Symbol("OMS protected verification authority");
+const PROTECTED_VERIFICATION_AUTHORITIES = new WeakSet();
+export function createProtectedVerificationAuthority(options) {
+    const packageRoot = validateExistingDirectory(options.packageRoot, "installed OMS package root");
+    const configRoot = validateExistingDirectory(options.configRoot, "protected verification config root");
+    const evidenceStore = options.evidenceStore;
+    assertEvidenceStore(evidenceStore);
+    const policy = loadTrackedRolePolicyGate(configRoot);
+    const plan = freezeTrackedVerificationPlan(configRoot);
+    const writer = createProtectedResultGateEvidenceWriter(evidenceStore);
+    const authority = Object.freeze({
+        [PROTECTED_VERIFICATION_AUTHORITY]: true,
+        policyVersion: policy.version,
+        policyDigest: policy.digest,
+        planDigest: plan.digest,
+        verify(subject) {
+            assertCurrentProtection(configRoot, policy, plan.digest);
+            const binding = captureProtectedVerificationBinding(subject);
+            validateExecutorEvidence(evidenceStore, binding);
+            const evidenceId = createStableId("det-check", binding.goal_id, String(binding.goal_version), binding.dispatch_id, String(binding.dispatch_version), String(binding.attempt), binding.lease_token, binding.worker_record_id, binding.expected_commit);
+            const existing = evidenceStore.references("deterministic-check")
+                .find((reference) => reference.evidence_id === evidenceId);
+            if (existing) {
+                probeProtectedVerificationWorktree(binding);
+                const record = evidenceStore.read(existing);
+                validateReplay(record, binding, policy.version, policy.digest, plan.digest);
+                return outcomeFromRecord("replayed", existing, record);
+            }
+            const run = runProtectedVerification({
+                packageRoot,
+                frozenPlan: plan,
+                policyVersion: policy.version,
+                policyDigest: policy.digest,
+                binding,
+            });
+            const written = writer.writeDeterministic({
+                evidenceId,
+                createdAt: new Date().toISOString(),
+                run,
+            });
+            return {
+                status: written.status,
+                ref: written.ref,
+                record: written.record,
+                verification: run.verification,
+                preflight: run.preflight,
+                postflight: run.postflight,
+            };
+        },
+        writeGrade(record, source) {
+            assertCurrentProtection(configRoot, policy, plan.digest);
+            const deterministic = evidenceStore.read(record.payload.deterministic_evidence);
+            if (deterministic.evidence_kind !== "deterministic-check"
+                || deterministic.payload.certification !== "live"
+                || deterministic.payload.policy_version !== policy.version
+                || deterministic.payload.policy_digest !== policy.digest
+                || deterministic.payload.plan_digest !== plan.digest) {
+                throw new Error("protected grade does not reference this authority's live deterministic check");
+            }
+            for (const reserved of ["provider_request_id", "grader_engine", "fresh_session_id"]) {
+                if (reserved in record.payload)
+                    throw new Error(`grader output contains reserved provider field: ${reserved}`);
+            }
+            const identity = captureProtectedGradeSource(source);
+            const executorEngine = deterministic.payload.binding.executor_engine;
+            const expectedRole = executorEngine === "claude" ? "oms.grader.codex" : "oms.grader.claude";
+            const expectedRequestId = createStableId("grade-request", record.payload.deterministic_evidence.evidence_id, record.payload.deterministic_evidence.sha256);
+            if (identity.role_id !== expectedRole
+                || record.producer_role !== expectedRole
+                || identity.request_id !== expectedRequestId)
+                throw new Error("protected grade does not match the gate's exact opposite-engine request");
+            const protectedRecord = {
+                ...record,
+                payload: {
+                    ...record.payload,
+                    provider_request_id: identity.request_id,
+                    grader_engine: identity.engine,
+                    fresh_session_id: identity.fresh_session_id,
+                },
+            };
+            return writer.writeGrade(protectedRecord, source);
+        },
+    });
+    PROTECTED_VERIFICATION_AUTHORITIES.add(authority);
+    return authority;
+}
+export function assertProtectedVerificationAuthority(value) {
+    if (typeof value !== "object" || value === null || !PROTECTED_VERIFICATION_AUTHORITIES.has(value)) {
+        throw new Error("verification requires a real OMS protected authority");
+    }
+    if (!Object.isFrozen(value))
+        throw new Error("protected verification authority lost its frozen boundary");
+}
+function assertCurrentProtection(configRoot, policy, planDigest) {
+    assertTrackedRolePolicyGate(policy, configRoot);
+    if (freezeTrackedVerificationPlan(configRoot).digest !== planDigest) {
+        throw new Error("protected verification plan changed after authority creation");
+    }
+}
+function validateExecutorEvidence(store, binding) {
+    const record = store.read(binding.executor_evidence);
+    const expectedKind = binding.executor_role === "oms.ticket-executor" ? "executor-result" : "goal-executor-result";
+    if (record.evidence_kind !== expectedKind
+        || record.producer_role !== binding.executor_role
+        || record.ticket_id !== binding.ticket_id
+        || record.payload.attempt !== binding.attempt
+        || record.payload.lease_token !== binding.lease_token) {
+        throw new Error("executor evidence does not match the protected verification binding");
+    }
+    if (binding.executor_role === "oms.ticket-executor") {
+        if (record.payload.status !== "done" || record.payload.ticket_id !== binding.ticket_id) {
+            throw new Error("ticket executor did not produce a completed result");
+        }
+    }
+    else if (record.payload.status !== "complete" || record.payload.goal_id !== binding.goal_id) {
+        throw new Error("goal executor did not produce a completed result");
+    }
+}
+function validateReplay(record, binding, policyVersion, policyDigest, planDigest) {
+    if (record.evidence_kind !== "deterministic-check"
+        || record.ticket_id !== binding.ticket_id
+        || record.payload.certification !== "live"
+        || record.payload.policy_version !== policyVersion
+        || record.payload.policy_digest !== policyDigest
+        || record.payload.plan_digest !== planDigest
+        || JSON.stringify(record.payload.binding) !== JSON.stringify(binding)) {
+        throw new Error("stored protected verification evidence does not match this run");
+    }
+}
+function outcomeFromRecord(status, ref, record) {
+    return {
+        status,
+        ref,
+        record,
+        verification: {
+            schema_version: 1,
+            plan_digest: record.payload.plan_digest,
+            passed: record.payload.passed,
+            failed_step: record.payload.failed_step,
+            steps: structuredClone(record.payload.steps),
+        },
+        preflight: structuredClone(record.payload.preflight),
+        postflight: structuredClone(record.payload.postflight),
+    };
+}
+//# sourceMappingURL=authority.js.map

package/dist/src/verification/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../../src/verification/authority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,uCAAuC,GAKxC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,mCAAmC,EACnC,kCAAkC,EAClC,wBAAwB,GAGzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,GAE5B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,gCAAgC,GAAG,MAAM,CAAC,sCAAsC,CAAC,CAAC;AACxF,MAAM,kCAAkC,GAAG,IAAI,OAAO,EAAU,CAAC;AAoBjE,MAAM,UAAU,oCAAoC,CAAC,OAIpD;IACC,MAAM,WAAW,GAAG,yBAAyB,CAAC,OAAO,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;IACvG,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,uCAAuC,CAAC,aAAa,CAAC,CAAC;IAEtE,MAAM,SAAS,GAAmC,MAAM,CAAC,MAAM,CAAC;QAC9D,CAAC,gCAAgC,CAAC,EAAE,IAAa;QACjD,aAAa,EAAE,MAAM,CAAC,OAAO;QAC7B,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,MAAM,CAAC,OAAqC;YAC1C,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;YAC7D,wBAAwB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,cAAc,CAC/B,WAAW,EACX,OAAO,CAAC,OAAO,EACf,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAC5B,OAAO,CAAC,WAAW,EACnB,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAChC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EACvB,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,eAAe,CACxB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC;iBAC7D,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;YAC7D,IAAI,QAAQ,EAAE,CAAC;gBACb,kCAAkC,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5C,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC5E,OAAO,iBAAiB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,GAAG,GAAG,wBAAwB,CAAC;gBACnC,WAAW;gBACX,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,MAAM,CAAC,OAAO;gBAC7B,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,OAAO;aACR,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBACxC,UAAU;gBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,GAAG;aACJ,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,MAAsB,EAAE,MAA4B;YAC7D,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sBAA2C,CAAC,CAAC;YACrG,IACE,aAAa,CAAC,aAAa,KAAK,qBAAqB;mBAClD,aAAa,CAAC,OAAO,CAAC,aAAa,KAAK,MAAM;mBAC9C,aAAa,CAAC,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,OAAO;mBACvD,aAAa,CAAC,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM;mBACrD,aAAa,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,EACpD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;YAClG,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,CAAC,qBAAqB,EAAE,eAAe,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBACpF,IAAI,QAAQ,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,cAAc,GAAI,aAAa,CAAC,OAAO,CAAC,OAAmC,CAAC,eAAe,CAAC;YAClG,MAAM,YAAY,GAAG,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAC;YAC5F,MAAM,iBAAiB,GAAG,cAAc,CACtC,eAAe,EACd,MAAM,CAAC,OAAO,CAAC,sBAA4C,CAAC,WAAW,EACvE,MAAM,CAAC,OAAO,CAAC,sBAA4C,CAAC,MAAM,CACpE,CAAC;YACF,IACE,QAAQ,CAAC,OAAO,KAAK,YAAY;mBAC9B,MAAM,CAAC,aAAa,KAAK,YAAY;mBACrC,QAAQ,CAAC,UAAU,KAAK,iBAAiB;gBAC5C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;YAC7F,MAAM,eAAe,GAAmB;gBACtC,GAAG,MAAM;gBACT,OAAO,EAAE;oBACP,GAAG,MAAM,CAAC,OAAO;oBACjB,mBAAmB,EAAE,QAAQ,CAAC,UAAU;oBACxC,aAAa,EAAE,QAAQ,CAAC,MAAM;oBAC9B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;iBAC5C;aACF,CAAC;YACF,OAAO,MAAM,CAAC,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;KACF,CAAC,CAAC;IACH,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAkB,EAClB,MAAoD,EACpD,UAAkB;IAElB,2BAA2B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,6BAA6B,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAoB,EAAE,OAAqC;IAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,KAAK,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAClH,IACE,MAAM,CAAC,aAAa,KAAK,YAAY;WAClC,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;WAC9C,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;WACtC,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;WAC1C,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EACrD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,MAAsB,EACtB,OAAqC,EACrC,aAAqB,EACrB,YAAoB,EACpB,UAAkB;IAElB,IACE,MAAM,CAAC,aAAa,KAAK,qBAAqB;WAC3C,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;WACtC,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,MAAM;WACvC,MAAM,CAAC,OAAO,CAAC,cAAc,KAAK,aAAa;WAC/C,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,YAAY;WAC7C,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,UAAU;WACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAkB,EAClB,GAAsB,EACtB,MAAsB;IAEtB,OAAO;QACL,MAAM;QACN,GAAG;QACH,MAAM;QACN,YAAY,EAAE;YACZ,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAqB;YACjD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAiB;YACxC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAA4B;YACxD,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAgC;SAC5E;QACD,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAA8B;QACjF,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAA8B;KACpF,CAAC;AACJ,CAAC"}

package/dist/src/verification/grade-source.d.ts

@@ -0,0 +1,17 @@
+import type { ClaudeStructuredResult } from "../providers/claude-structured-store.js";
+import { type CodexStructuredResult } from "../providers/codex-exec.js";
+export type ProtectedGradeSource = Readonly<{
+    engine: "codex";
+    result: CodexStructuredResult<Record<string, unknown>>;
+}> | Readonly<{
+    engine: "claude";
+    result: ClaudeStructuredResult;
+}>;
+export interface ProtectedGradeSourceIdentity {
+    readonly engine: "codex" | "claude";
+    readonly role_id: "oms.grader.codex" | "oms.grader.claude";
+    readonly request_id: string;
+    readonly fresh_session_id: string;
+    readonly output: Readonly<Record<string, unknown>>;
+}
+export declare function captureProtectedGradeSource(source: ProtectedGradeSource): ProtectedGradeSourceIdentity;