owlrunkit 0.19.1 → 0.20.0

package/scripts/runkit-contract/onboarding-doctor.mjs

@@ -28,10 +28,12 @@ const MAX_JSON_DEPTH = 64;
 const MAX_JSON_NODES = 50_000;
 
 class StrictJsonParser {
-  constructor(text) {
+  constructor(text, { maxDepth = MAX_JSON_DEPTH, maxNodes = MAX_JSON_NODES } = {}) {
     this.text = text;
     this.index = 0;
     this.nodes = 0;
+    this.maxDepth = maxDepth;
+    this.maxNodes = maxNodes;
   }
 
   parse() {
@@ -44,7 +46,7 @@ class StrictJsonParser {
   parseValue(depth) {
     this.skipWhitespace();
     this.nodes += 1;
-    if (this.nodes > MAX_JSON_NODES) throw new Error("JSON input exceeds the node limit");
+    if (this.nodes > this.maxNodes) throw new Error("JSON input exceeds the node limit");
     const character = this.text[this.index];
     if (character === "{") return this.parseObject(depth);
     if (character === "[") return this.parseArray(depth);
@@ -165,7 +167,7 @@ class StrictJsonParser {
 
   enter(depth) {
     const nextDepth = depth + 1;
-    if (nextDepth > MAX_JSON_DEPTH) throw new Error("JSON input exceeds the nesting limit");
+    if (nextDepth > this.maxDepth) throw new Error("JSON input exceeds the nesting limit");
     return nextDepth;
   }
 
@@ -180,11 +182,15 @@ class StrictJsonParser {
   }
 }
 
-function parseJsonStrict(text) {
-  if (typeof text !== "string" || Buffer.byteLength(text, "utf8") > MAX_JSON_BYTES) {
+function parseJsonStrict(text, {
+  maxBytes = MAX_JSON_BYTES,
+  maxDepth = MAX_JSON_DEPTH,
+  maxNodes = MAX_JSON_NODES,
+} = {}) {
+  if (typeof text !== "string" || Buffer.byteLength(text, "utf8") > maxBytes) {
     throw new Error("JSON input exceeds the input-byte limit");
   }
-  return new StrictJsonParser(text).parse();
+  return new StrictJsonParser(text, { maxDepth, maxNodes }).parse();
 }
 
 export function resolveBoundedWorkspaceRoot(workspaceRoot) {
@@ -212,7 +218,10 @@ function identityMatches(left, right) {
     && left.mtimeMs === right.mtimeMs;
 }
 
-export function readWorkspaceFileBounded(root, relativePath, { optional = false } = {}) {
+export function readWorkspaceBytesBounded(root, relativePath, {
+  optional = false,
+  maxBytes = MAX_JSON_BYTES,
+} = {}) {
   const target = path.resolve(root, relativePath);
   if (!strictDescendant(root, target)) throw new Error("workspace file escaped the workspace root");
   const segments = path.relative(root, target).split(path.sep);
@@ -238,17 +247,16 @@ export function readWorkspaceFileBounded(root, relativePath, { optional = false
   const descriptor = openSync(target, "r");
   try {
     const before = fstatSync(descriptor);
-    if (!before.isFile() || before.size > MAX_JSON_BYTES) {
+    if (!before.isFile() || before.size > maxBytes) {
       throw new Error("workspace file exceeds the input-byte limit");
     }
-    const buffer = Buffer.allocUnsafe(MAX_JSON_BYTES + 1);
+    const buffer = Buffer.allocUnsafe(before.size);
     let offset = 0;
-    while (offset <= MAX_JSON_BYTES) {
+    while (offset < buffer.length) {
       const bytesRead = readSync(descriptor, buffer, offset, buffer.length - offset, offset);
       if (bytesRead === 0) break;
       offset += bytesRead;
     }
-    if (offset > MAX_JSON_BYTES) throw new Error("workspace file exceeds the input-byte limit");
     const after = fstatSync(descriptor);
     const currentStat = lstatSync(target);
     if (
@@ -260,15 +268,22 @@ export function readWorkspaceFileBounded(root, relativePath, { optional = false
     ) {
       throw new Error("workspace file identity changed while reading");
     }
-    return new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, offset));
+    return buffer.subarray(0, offset);
   } finally {
     closeSync(descriptor);
   }
 }
 
+export function readWorkspaceFileBounded(root, relativePath, options) {
+  const bytes = readWorkspaceBytesBounded(root, relativePath, options);
+  return bytes === null
+    ? null
+    : new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+
 export function readWorkspaceJsonBounded(root, relativePath, options) {
   const text = readWorkspaceFileBounded(root, relativePath, options);
-  return text === null ? null : parseJsonStrict(text);
+  return text === null ? null : parseJsonStrict(text, options);
 }
 
 async function readResponseJsonBounded(response) {
@@ -549,6 +564,10 @@ function runtimeIsolationCheck(root) {
   };
 }
 
+export function inspectRuntimeIsolationV1({ workspaceRoot } = {}) {
+  return runtimeIsolationCheck(resolveBoundedWorkspaceRoot(workspaceRoot));
+}
+
 function configCheck(root) {
   try {
     const config = readWorkspaceJsonBounded(

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -15,9 +15,16 @@ const MAX_CORE_TOTAL_BYTES = 67_108_864;
 const PACKAGE_NAME = "owlrunkit";
 const OFFICIAL_CLI_ENTRYPOINT =
   "scripts/runkit-contract/runkit-bootstrap.mjs";
+const SELF_NORMALIZED_QUICK_CORE_VERSIONS = new Set(["0.19.2", "0.20.0"]);
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.19.2", new Set([
+    "sha256:c46ae9d8ed0572e5636ab5725f922f8db3ee5bf0f966b200bce7b2287c9267c8",
+  ])],
+  ["0.19.1", new Set([
+    "sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622",
+  ])],
   ["0.19.0", new Set([
     "sha256:803fb7de76a6ccffd1ec5e0164eeff15a580209fa6dfbef9e561345ab616b403",
   ])],
@@ -523,7 +530,28 @@ function coreFileList(coreContractSource, identifier) {
   return values;
 }
 
-function installedCoreManifestSha256(packageRoot) {
+function coreDependencyBytes(target, relativePath, version) {
+  const bytes = readFileSync(target);
+  if (relativePath !== "packages/attest/src/quick.mjs"
+    || !SELF_NORMALIZED_QUICK_CORE_VERSIONS.has(version)) return bytes;
+  const source = bytes.toString("utf8");
+  const escapedVersion = version.replaceAll(".", "\\.");
+  const currentIdentity = new RegExp(
+    `(coreVersion:\\s*"${escapedVersion}",\\s*coreManifestSha256:\\s*")`
+      + "sha256:[a-f0-9]{64}(\")",
+    "gu",
+  );
+  const matches = [...source.matchAll(currentIdentity)];
+  if (matches.length !== 1) {
+    throw new Error("project_cli_core_contract_invalid");
+  }
+  return Buffer.from(source.replace(
+    currentIdentity,
+    `$1sha256:${"0".repeat(64)}$2`,
+  ));
+}
+
+function installedCoreManifestSha256(packageRoot, version) {
   const coreRoot = path.join(packageRoot, "scripts", "runkit-contract");
   const coreContractPath = path.join(coreRoot, "core-contract.mjs");
   assertRegularDescendant(
@@ -570,7 +598,9 @@ function installedCoreManifestSha256(packageRoot) {
     ) {
       throw new Error("project_cli_core_closure_too_large");
     }
-    return `${relativePath}\tsha256:${sha256(readFileSync(target))}\n`;
+    return `${relativePath}\tsha256:${sha256(
+      coreDependencyBytes(target, relativePath, version),
+    )}\n`;
   }).join("");
   return `sha256:${sha256(stream)}`;
 }
@@ -629,7 +659,7 @@ function verifyInstalledCoreBinding(root, packageRoot, version) {
 }
 
 function verifyInstalledCoreClosure(packageRoot, version) {
-  const actualCoreManifestSha256 = installedCoreManifestSha256(packageRoot);
+  const actualCoreManifestSha256 = installedCoreManifestSha256(packageRoot, version);
   const trusted = trustedCoreManifestHashes(version);
   if (!trusted.hashes.has(actualCoreManifestSha256)) {
     throw new Error("project_cli_untrusted_core_identity");

package/scripts/runkit-contract/project-external-delivery.mjs

@@ -30,6 +30,7 @@ import {
   appendTeamProjectEventV1,
   normalizeTeamProjectDefinitionV1,
   readTeamProjectStatusV2,
+  readTeamProjectStatusV3,
   teamProjectDefinitionBindingV1,
   withTeamProjectControlLockV1,
 } from "./team-project.mjs";
@@ -85,11 +86,14 @@ function artifactSha256(value) {
 
 function validateTimestamp(value, label) {
   if (typeof value !== "string"
-    || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(value)
+    || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/u.test(value)
     || Number.isNaN(Date.parse(value))) {
-    throw new Error(`${label} must be an ISO-8601 UTC timestamp.`);
+    throw new Error(
+      `${label} must be an ISO-8601 UTC timestamp `
+      + "(YYYY-MM-DDTHH:mm:ssZ or YYYY-MM-DDTHH:mm:ss.sssZ).",
+    );
   }
-  return value;
+  return new Date(value).toISOString();
 }
 
 function compareIdentifiers(left, right) {
@@ -256,12 +260,13 @@ export function captureTargetWorkspaceSnapshotV1({
   apply = false,
 }) {
   safeIdentifier(snapshotId, "snapshotId");
-  validateTimestamp(occurredAt, "Target snapshot capturedAt");
+  occurredAt = validateTimestamp(occurredAt, "Target snapshot capturedAt");
   const controllerRoot = canonicalControllerRoot(controllerWorkspaceRoot);
   const targetRoot = canonicalTargetRoot(targetWorkspaceRoot);
   assertDisjointWorkspaces(controllerRoot, targetRoot);
   const definition = readProjectDefinition(controllerRoot);
-  const workItem = definition.workItems.find(row => row.id === workItemId);
+  const workItem = readTeamProjectStatusV3({ workspaceRoot: controllerRoot })
+    .workItems.find(row => row.workItemId === workItemId);
   if (!workItem) throw new Error(`Unknown team project WorkItem: ${workItemId}.`);
   const projectBinding = teamProjectDefinitionBindingV1(definition);
   const selectedAllowedPaths = resolveAllowedPaths(workItem, allowedPaths);
@@ -293,11 +298,12 @@ export function captureTargetWorkspaceSnapshotV1({
 
   const persisted = withTeamProjectControlLockV1({
     workspaceRoot: controllerRoot,
-    operation({ definition: currentDefinition, definitionBinding }) {
+    operation({ definitionBinding }) {
       if (canonical(definitionBinding) !== canonical(projectBinding)) {
         throw new Error("Team project identity changed before target snapshot persistence.");
       }
-      const currentWorkItem = currentDefinition.workItems.find(row => row.id === workItemId);
+      const currentWorkItem = readTeamProjectStatusV3({ workspaceRoot: controllerRoot })
+        .workItems.find(row => row.workItemId === workItemId);
       if (!currentWorkItem
         || canonical(resolveAllowedPaths(currentWorkItem, selectedAllowedPaths))
           !== canonical(selectedAllowedPaths)) {
@@ -549,12 +555,13 @@ export function importExternalDeliveryV1({
 }) {
   safeIdentifier(deliveryId, "deliveryId");
   safeIdentifier(producerId, "producerId");
-  validateTimestamp(occurredAt, "External delivery occurredAt");
+  occurredAt = validateTimestamp(occurredAt, "External delivery occurredAt");
   const controllerRoot = canonicalControllerRoot(controllerWorkspaceRoot);
   const targetRoot = canonicalTargetRoot(targetWorkspaceRoot);
   assertDisjointWorkspaces(controllerRoot, targetRoot);
   const definition = readProjectDefinition(controllerRoot);
-  const workItem = definition.workItems.find(row => row.id === workItemId);
+  const workItem = readTeamProjectStatusV3({ workspaceRoot: controllerRoot })
+    .workItems.find(row => row.workItemId === workItemId);
   if (!workItem) throw new Error(`Unknown team project WorkItem: ${workItemId}.`);
   const projectBinding = teamProjectDefinitionBindingV1(definition);
   validateCurrentAssignment(controllerRoot, workItemId, assignmentId);

package/scripts/runkit-contract/quick-attest.mjs

@@ -1,5 +1,29 @@
+import {
+  SUPPORTED_QUICK_CORE_IDENTITIES,
+  attestQuickReceiptDetailsFromBytesWithCoreCatalog,
+} from "../../packages/attest/src/quick.mjs";
+import { currentCoreIdentity } from "./core-contract.mjs";
+
 export {
   attestQuickReceipt,
   attestQuickReceiptDetails,
+  attestQuickReceiptDetailsFromBytes,
   validQuickReceiptShape,
 } from "../../packages/attest/src/quick.mjs";
+
+function coreBoundCatalog() {
+  const current = currentCoreIdentity();
+  return [
+    current,
+    ...SUPPORTED_QUICK_CORE_IDENTITIES.filter((identity) => (
+      identity.coreVersion !== current.coreVersion
+    )),
+  ];
+}
+
+export function attestCoreBoundQuickReceiptDetailsFromBytes(options) {
+  return attestQuickReceiptDetailsFromBytesWithCoreCatalog(
+    options,
+    coreBoundCatalog(),
+  );
+}