project-tiny-context-harness 0.11.0 → 0.12.0

package/dist/lib/design-resource-symbolic-noninterference-shape.js

@@ -1,152 +0,0 @@
-import { nonnegativeInteger, sha256, stableKey, stableKeys, } from "./design-resource-handoff-shape-primitives.js";
-import { parseSymbolicPredicate } from "./design-resource-symbolic-predicate-shape.js";
-import { array, literal, nullable, object, string, } from "./long-task-shape-primitives.js";
-export function parseSymbolicNoninterferenceProof(value, label) {
-    const row = object(value, label, [
-        "side",
-        "method",
-        "input_resource_refs",
-        "oracle_ref",
-        "environment_ref",
-        "static_dependency_nodes",
-        "static_rule_roots",
-        "equivalence_cases",
-        "dynamic_dependency_kinds",
-        "external_device_refs",
-        "complete_domain_cardinality",
-        "oracle_version",
-        "oracle_implementation_sha256",
-        "oracle_capability",
-        "environment_sha256",
-        "input_snapshot_sha256",
-        "source_manifest_snapshot_sha256",
-        "target_snapshot_sha256",
-        "certificate_scope_sha256",
-        "rule_scope_sha256",
-        "omitted_axis_refs",
-        "method_result_sha256",
-        "artifact_resource_ref",
-        "artifact_path",
-        "artifact_sha256",
-        "failure_witness",
-    ]);
-    return {
-        side: literal(row.side, ["source", "production"], `${label}.side`),
-        method: literal(row.method, [
-            "closed_world_static_dependency_closure",
-            "restricted_ir_symbolic_equivalence",
-            "finite_complete_domain_exhaustive_equivalence",
-        ], `${label}.method`),
-        input_resource_refs: stableKeys(row.input_resource_refs, `${label}.input_resource_refs`),
-        oracle_ref: stableKey(row.oracle_ref, `${label}.oracle_ref`),
-        environment_ref: stableKey(row.environment_ref, `${label}.environment_ref`),
-        static_dependency_nodes: array(row.static_dependency_nodes, `${label}.static_dependency_nodes`).map((item, index) => parseStaticDependencyNode(item, `${label}.static_dependency_nodes[${index}]`)),
-        static_rule_roots: array(row.static_rule_roots, `${label}.static_rule_roots`).map((item, index) => parseStaticDependencyRoot(item, `${label}.static_rule_roots[${index}]`)),
-        equivalence_cases: array(row.equivalence_cases, `${label}.equivalence_cases`).map((item, index) => {
-            const itemLabel = `${label}.equivalence_cases[${index}]`;
-            const entry = object(item, itemLabel, [
-                "fact_rule_refs",
-                "side_predicate",
-                "axis_erased_predicate",
-            ]);
-            return {
-                fact_rule_refs: stableKeys(entry.fact_rule_refs, `${itemLabel}.fact_rule_refs`),
-                side_predicate: parseSymbolicPredicate(entry.side_predicate, `${itemLabel}.side_predicate`),
-                axis_erased_predicate: parseSymbolicPredicate(entry.axis_erased_predicate, `${itemLabel}.axis_erased_predicate`),
-            };
-        }),
-        dynamic_dependency_kinds: stableKeys(row.dynamic_dependency_kinds, `${label}.dynamic_dependency_kinds`),
-        external_device_refs: stableKeys(row.external_device_refs, `${label}.external_device_refs`),
-        complete_domain_cardinality: nullable(row.complete_domain_cardinality, (entry) => decimalCardinality(entry, `${label}.complete_domain_cardinality`)),
-        oracle_version: string(row.oracle_version, `${label}.oracle_version`),
-        oracle_implementation_sha256: sha256(row.oracle_implementation_sha256, `${label}.oracle_implementation_sha256`),
-        oracle_capability: string(row.oracle_capability, `${label}.oracle_capability`),
-        environment_sha256: sha256(row.environment_sha256, `${label}.environment_sha256`),
-        input_snapshot_sha256: sha256(row.input_snapshot_sha256, `${label}.input_snapshot_sha256`),
-        source_manifest_snapshot_sha256: nullable(row.source_manifest_snapshot_sha256, (entry) => sha256(entry, `${label}.source_manifest_snapshot_sha256`)),
-        target_snapshot_sha256: sha256(row.target_snapshot_sha256, `${label}.target_snapshot_sha256`),
-        certificate_scope_sha256: sha256(row.certificate_scope_sha256, `${label}.certificate_scope_sha256`),
-        rule_scope_sha256: sha256(row.rule_scope_sha256, `${label}.rule_scope_sha256`),
-        omitted_axis_refs: stableKeys(row.omitted_axis_refs, `${label}.omitted_axis_refs`),
-        method_result_sha256: sha256(row.method_result_sha256, `${label}.method_result_sha256`),
-        artifact_resource_ref: stableKey(row.artifact_resource_ref, `${label}.artifact_resource_ref`),
-        artifact_path: string(row.artifact_path, `${label}.artifact_path`),
-        artifact_sha256: sha256(row.artifact_sha256, `${label}.artifact_sha256`),
-        failure_witness: nullable(row.failure_witness, (entry) => parseFailureWitness(entry, `${label}.failure_witness`)),
-    };
-}
-function parseFailureWitness(value, label) {
-    const row = object(value, label, [
-        "kind",
-        "side",
-        "certificate_scope_sha256",
-        "axis_ref",
-        "fact_rule_ref",
-        "resource_ref",
-        "path",
-        "locator",
-        "node_ref",
-        "byte_offset",
-        "assignment",
-        "detail",
-    ]);
-    return {
-        kind: literal(row.kind, [
-            "omitted_axis_dependency",
-            "unsupported_dependency",
-            "source_rule_denotation_mismatch",
-            "complete_domain_counterexample",
-        ], `${label}.kind`),
-        side: literal(row.side, ["source", "production"], `${label}.side`),
-        certificate_scope_sha256: sha256(row.certificate_scope_sha256, `${label}.certificate_scope_sha256`),
-        axis_ref: nullable(row.axis_ref, (entry) => stableKey(entry, `${label}.axis_ref`)),
-        fact_rule_ref: nullable(row.fact_rule_ref, (entry) => stableKey(entry, `${label}.fact_rule_ref`)),
-        resource_ref: nullable(row.resource_ref, (entry) => stableKey(entry, `${label}.resource_ref`)),
-        path: nullable(row.path, (entry) => string(entry, `${label}.path`)),
-        locator: nullable(row.locator, (entry) => string(entry, `${label}.locator`)),
-        node_ref: nullable(row.node_ref, (entry) => stableKey(entry, `${label}.node_ref`)),
-        byte_offset: nullable(row.byte_offset, (entry) => nonnegativeInteger(entry, `${label}.byte_offset`)),
-        assignment: nullable(row.assignment, (entry) => parseAssignment(entry, `${label}.assignment`)),
-        detail: string(row.detail, `${label}.detail`),
-    };
-}
-function parseAssignment(value, label) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        throw new Error(`${label}: must be an object`);
-    const result = {};
-    for (const [key, entry] of Object.entries(value)) {
-        stableKey(key, `${label}.key`);
-        if ((typeof entry !== "string" && typeof entry !== "number") ||
-            (typeof entry === "number" && !Number.isFinite(entry)))
-            throw new Error(`${label}.${key}: must be a finite scalar`);
-        result[key] = entry;
-    }
-    return result;
-}
-function parseStaticDependencyNode(value, label) {
-    const row = object(value, label, [
-        "key",
-        "axis_refs",
-        "dependency_refs",
-        "input_resource_refs",
-    ]);
-    return {
-        key: stableKey(row.key, `${label}.key`),
-        axis_refs: stableKeys(row.axis_refs, `${label}.axis_refs`),
-        dependency_refs: stableKeys(row.dependency_refs, `${label}.dependency_refs`),
-        input_resource_refs: stableKeys(row.input_resource_refs, `${label}.input_resource_refs`),
-    };
-}
-function parseStaticDependencyRoot(value, label) {
-    const row = object(value, label, ["fact_rule_refs", "node_ref"]);
-    return {
-        fact_rule_refs: nullable(row.fact_rule_refs, (entry) => stableKeys(entry, `${label}.fact_rule_refs`)),
-        node_ref: stableKey(row.node_ref, `${label}.node_ref`),
-    };
-}
-function decimalCardinality(value, label) {
-    const parsed = string(value, label);
-    if (!/^(?:0|[1-9][0-9]*)$/u.test(parsed))
-        throw new Error(`${label}: must be a canonical nonnegative decimal`);
-    return parsed;
-}

package/dist/lib/design-resource-symbolic-noninterference-types.d.ts

@@ -1,103 +0,0 @@
-import type { SymbolicDenotationPredicate, SymbolicDenotationScalar } from "./symbolic-denotation-types.js";
-export interface DesignResourceSymbolicNoninterferenceCertificateV2 {
-    key: string;
-    fact_rule_refs: string[];
-    omitted_axis_refs: string[];
-    dependency_edge_refs: string[];
-    canonical_rule_dag_sha256: string;
-    source_noninterference_proof?: DesignResourceSymbolicNoninterferenceProofV2 | null;
-    production_noninterference_proof?: DesignResourceSymbolicNoninterferenceProofV2 | null;
-}
-export type DesignResourceSymbolicNoninterferenceProofMethodV2 = "closed_world_static_dependency_closure" | "restricted_ir_symbolic_equivalence" | "finite_complete_domain_exhaustive_equivalence";
-export interface DesignResourceSymbolicNoninterferenceEquivalenceCaseV2 {
-    fact_rule_refs: string[];
-    side_predicate: SymbolicDenotationPredicate;
-    axis_erased_predicate: SymbolicDenotationPredicate;
-}
-export interface DesignResourceSymbolicStaticDependencyNodeV2 {
-    key: string;
-    axis_refs: string[];
-    dependency_refs: string[];
-    input_resource_refs: string[];
-}
-export interface DesignResourceSymbolicStaticDependencyRootV2 {
-    fact_rule_refs: string[] | null;
-    node_ref: string;
-}
-export interface DesignResourceSymbolicNoninterferenceFailureWitnessV1 {
-    kind: "omitted_axis_dependency" | "unsupported_dependency" | "source_rule_denotation_mismatch" | "complete_domain_counterexample";
-    side: "source" | "production";
-    certificate_scope_sha256: string;
-    axis_ref: string | null;
-    fact_rule_ref: string | null;
-    resource_ref: string | null;
-    path: string | null;
-    locator: string | null;
-    node_ref: string | null;
-    byte_offset: number | null;
-    assignment: Record<string, SymbolicDenotationScalar> | null;
-    detail: string;
-}
-export interface DesignResourceSymbolicNoninterferenceInputBindingV2 {
-    resource_ref: string;
-    path: string;
-    declared_sha256: string;
-    current_sha256: string;
-}
-export interface DesignResourceSymbolicNoninterferenceDerivedResultV2 {
-    source_ir_resource_ref: string | null;
-    static_dependency_nodes: DesignResourceSymbolicStaticDependencyNodeV2[];
-    static_rule_roots: DesignResourceSymbolicStaticDependencyRootV2[];
-    equivalence_cases: DesignResourceSymbolicNoninterferenceEquivalenceCaseV2[];
-    complete_domain_cardinality: string | null;
-    exhaustive_evaluation_sha256: string | null;
-}
-export interface DesignResourceSymbolicNoninterferenceArtifactV2 {
-    schema_version: "design-resource-symbolic-noninterference-artifact-v2";
-    side: "source" | "production";
-    method: DesignResourceSymbolicNoninterferenceProofMethodV2;
-    oracle_identity: string;
-    oracle_version: string;
-    oracle_implementation_sha256: string;
-    oracle_capability: string;
-    environment_sha256: string;
-    input_resources: DesignResourceSymbolicNoninterferenceInputBindingV2[];
-    input_snapshot_sha256: string;
-    source_manifest_snapshot_sha256: string | null;
-    target_snapshot_sha256: string;
-    certificate_scope_sha256: string;
-    rule_scope_sha256: string;
-    omitted_axis_refs: string[];
-    derived_result: DesignResourceSymbolicNoninterferenceDerivedResultV2;
-    method_result_sha256: string;
-    verdict: "passed" | "failed";
-    failure_witness: DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;
-}
-export interface DesignResourceSymbolicNoninterferenceProofV2 {
-    side: "source" | "production";
-    method: DesignResourceSymbolicNoninterferenceProofMethodV2;
-    input_resource_refs: string[];
-    oracle_ref: string;
-    environment_ref: string;
-    static_dependency_nodes: DesignResourceSymbolicStaticDependencyNodeV2[];
-    static_rule_roots: DesignResourceSymbolicStaticDependencyRootV2[];
-    equivalence_cases: DesignResourceSymbolicNoninterferenceEquivalenceCaseV2[];
-    dynamic_dependency_kinds: string[];
-    external_device_refs: string[];
-    complete_domain_cardinality: string | null;
-    oracle_version: string;
-    oracle_implementation_sha256: string;
-    oracle_capability: string;
-    environment_sha256: string;
-    input_snapshot_sha256: string;
-    source_manifest_snapshot_sha256: string | null;
-    target_snapshot_sha256: string;
-    certificate_scope_sha256: string;
-    rule_scope_sha256: string;
-    omitted_axis_refs: string[];
-    method_result_sha256: string;
-    artifact_resource_ref: string;
-    artifact_path: string;
-    artifact_sha256: string;
-    failure_witness: DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;
-}

package/dist/lib/design-resource-symbolic-noninterference-types.js

@@ -1 +0,0 @@
-export {};

package/dist/lib/design-resource-symbolic-noninterference-validation.d.ts

@@ -1,5 +0,0 @@
-import type { DesignResourceSymbolicCompilationSession } from "./design-resource-symbolic-compilation.js";
-import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
-import type { DesignResourceHandoffPreflightV2, DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceCertificateV2 } from "./design-resource-symbolic-fact-types.js";
-import type { SymbolicManifestIndexes } from "./design-resource-symbolic-indexes.js";
-export declare function validateTrustedSymbolicNoninterference(manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, projections: DesignResourceHandoffPreflightV2["rule_projections"], indexes: SymbolicManifestIndexes, compilation: DesignResourceSymbolicCompilationSession, target: DesignResourceHandoffPreflightV2["handoff"]["targets"][number], resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>): void;

package/dist/lib/design-resource-symbolic-noninterference-validation.js

@@ -1,62 +0,0 @@
-import { DESIGN_RESOURCE_SYMBOLIC_NONINTERFERENCE_ORACLE_CAPABILITIES, } from "./design-resource-fact-enums.js";
-import { validateSymbolicNoninterferenceEquivalence } from "./design-resource-symbolic-noninterference-equivalence.js";
-import { validateStaticDependencyClosure } from "./design-resource-symbolic-static-dependency-validation.js";
-import { validateSymbolicNoninterferenceArtifact } from "./design-resource-symbolic-noninterference-artifact.js";
-import { assertSameSet, invalid, unique, } from "./design-resource-symbolic-validation-support.js";
-export function validateTrustedSymbolicNoninterference(manifest, certificate, projections, indexes, compilation, target, resources, contents) {
-    if (!certificate.omitted_axis_refs.length) {
-        if (certificate.source_noninterference_proof != null ||
-            certificate.production_noninterference_proof != null)
-            invalid("v2_noninterference_proof_without_omission", certificate.key);
-        return;
-    }
-    const proofs = [
-        ["source", certificate.source_noninterference_proof],
-        ["production", certificate.production_noninterference_proof],
-    ];
-    for (const [side, proof] of proofs) {
-        if (!proof)
-            invalid("v2_noninterference_proof_unavailable", `${certificate.key}:${side}:${certificate.omitted_axis_refs.join(",")}`);
-        validateProof(side, proof, manifest, certificate, projections, indexes, compilation, target, resources, contents);
-    }
-}
-function validateProof(expectedSide, proof, manifest, certificate, projections, indexes, compilation, target, resources, contents) {
-    if (proof.side !== expectedSide)
-        invalid("v2_noninterference_proof_side_mismatch", `${certificate.key}:${expectedSide}:${proof.side}`);
-    assertSameSet(proof.input_resource_refs, manifest.inspector.input_resources.map((item) => item.resource_ref), "v2_noninterference_input_closure_mismatch", `${certificate.key}:${expectedSide}`);
-    if (!indexes.oracles.has(proof.oracle_ref))
-        invalid("v2_noninterference_oracle_unknown", proof.oracle_ref);
-    const oracle = indexes.oracles.get(proof.oracle_ref);
-    if (oracle.trust !== "frozen_executable" || oracle.sha256 === null)
-        invalid("v2_noninterference_frozen_oracle_required", proof.oracle_ref);
-    const requiredCapability = `symbolic_noninterference.${expectedSide}.${proof.method}`;
-    if (!isNoninterferenceOracleCapability(requiredCapability))
-        invalid("v2_noninterference_oracle_capability_unregistered", requiredCapability);
-    if (!oracle.capability_refs.includes(requiredCapability))
-        invalid("v2_noninterference_oracle_capability_missing", `${proof.oracle_ref}:${requiredCapability}`);
-    if (proof.oracle_capability !== requiredCapability)
-        invalid("v2_noninterference_oracle_capability_binding_mismatch", `${certificate.key}:${proof.oracle_capability}:${requiredCapability}`);
-    if (!indexes.environments.has(proof.environment_ref))
-        invalid("v2_noninterference_environment_unknown", proof.environment_ref);
-    if (proof.dynamic_dependency_kinds.length)
-        invalid("v2_noninterference_dynamic_dependency_unproved", `${certificate.key}:${proof.dynamic_dependency_kinds.join(",")}`);
-    if (proof.external_device_refs.length)
-        invalid("v2_noninterference_external_device_unproved", `${certificate.key}:${proof.external_device_refs.join(",")}`);
-    unique(proof.input_resource_refs, `v2_noninterference_input_duplicate:${certificate.key}:${expectedSide}`);
-    unique(proof.dynamic_dependency_kinds, `v2_noninterference_dynamic_dependency_duplicate:${certificate.key}:${expectedSide}`);
-    unique(proof.external_device_refs, `v2_noninterference_external_device_duplicate:${certificate.key}:${expectedSide}`);
-    assertSameSet(proof.omitted_axis_refs, certificate.omitted_axis_refs, "v2_noninterference_artifact_omitted_axis_mismatch", `${certificate.key}:${expectedSide}`);
-    if (expectedSide === "source") {
-        validateSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents);
-        return;
-    }
-    if (proof.method === "closed_world_static_dependency_closure") {
-        validateStaticDependencyClosure(proof, certificate, projections, manifest);
-    }
-    else
-        validateSymbolicNoninterferenceEquivalence(proof, manifest, certificate, projections, compilation);
-    validateSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents);
-}
-function isNoninterferenceOracleCapability(value) {
-    return DESIGN_RESOURCE_SYMBOLIC_NONINTERFERENCE_ORACLE_CAPABILITIES.includes(value);
-}

package/dist/lib/design-resource-symbolic-oracle-fingerprint.d.ts

@@ -1 +0,0 @@
-export declare function fingerprintExecutableModuleClosure(entryUrls: readonly string[]): string;

package/dist/lib/design-resource-symbolic-oracle-fingerprint.js

@@ -1,47 +0,0 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-const LOCAL_MODULE_IMPORT = /(?:\bfrom\s*|\bimport\s*)["'](\.[^"']+\.js)["']/gu;
-const DYNAMIC_MODULE_IMPORT = /\bimport\s*\(/gu;
-const HIDDEN_LOCAL_LOADER = /\b(?:createRequire|require)\s*\(/gu;
-export function fingerprintExecutableModuleClosure(entryUrls) {
-    const pending = [...new Set(entryUrls)].sort();
-    const seen = new Map();
-    while (pending.length) {
-        const url = pending.shift();
-        if (seen.has(url))
-            continue;
-        const bytes = readFileSync(fileURLToPath(url));
-        const source = bytes.toString("utf8");
-        if (DYNAMIC_MODULE_IMPORT.test(source))
-            throw new Error(`symbolic Oracle implementation uses dynamic import: ${url}`);
-        DYNAMIC_MODULE_IMPORT.lastIndex = 0;
-        if (HIDDEN_LOCAL_LOADER.test(source))
-            throw new Error(`symbolic Oracle implementation uses a hidden local loader: ${url}`);
-        HIDDEN_LOCAL_LOADER.lastIndex = 0;
-        seen.set(url, bytes);
-        for (const specifier of localModuleImports(source)) {
-            const dependencyUrl = new URL(specifier, url).href;
-            if (!seen.has(dependencyUrl))
-                pending.push(dependencyUrl);
-        }
-        pending.sort();
-    }
-    const commonRoot = path.dirname(fileURLToPath([...seen.keys()].sort()[0] ?? entryUrls[0]));
-    const entries = [...seen.entries()]
-        .map(([url, bytes]) => ({
-        path: path
-            .relative(commonRoot, fileURLToPath(url))
-            .replaceAll(path.sep, "/"),
-        sha256: createHash("sha256").update(bytes).digest("hex"),
-    }))
-        .sort((left, right) => left.path.localeCompare(right.path, "en"));
-    return createHash("sha256").update(JSON.stringify(entries)).digest("hex");
-}
-function localModuleImports(source) {
-    const result = [];
-    for (const match of source.matchAll(LOCAL_MODULE_IMPORT))
-        result.push(match[1]);
-    return result;
-}

package/dist/lib/design-resource-symbolic-predicate-shape.d.ts

@@ -1,6 +0,0 @@
-import type { SymbolicDenotationAxisDomain, SymbolicDenotationPredicate } from "./symbolic-denotation-types.js";
-export declare function parseSymbolicAxisDomains(value: unknown, label: string): SymbolicDenotationAxisDomain[];
-export declare function parseSymbolicPredicate(value: unknown, label: string): SymbolicDenotationPredicate;
-export declare function parseSymbolicScalar(value: unknown, label: string): string | number;
-export declare function parseSymbolicSafeInteger(value: unknown, label: string): number;
-export declare function parseSymbolicNonnegativeInteger(value: unknown, label: string): number;

package/dist/lib/design-resource-symbolic-predicate-shape.js

@@ -1,123 +0,0 @@
-import { stableKey, stableKeys, } from "./design-resource-handoff-shape-primitives.js";
-import { array, boolean, literal, object, } from "./long-task-shape-primitives.js";
-export function parseSymbolicAxisDomains(value, label) {
-    return array(value, label).map((item, index) => {
-        const itemLabel = `${label}[${index}]`;
-        const kindValue = object(item, itemLabel, ["key", "kind"], ["values", "minimum", "maximum", "integer"]).kind;
-        if (kindValue === "enum") {
-            const row = object(item, itemLabel, ["key", "kind", "values"]);
-            return {
-                key: stableKey(row.key, `${itemLabel}.key`),
-                kind: literal(row.kind, ["enum"], `${itemLabel}.kind`),
-                values: stableKeys(row.values, `${itemLabel}.values`),
-            };
-        }
-        const row = object(item, itemLabel, [
-            "key",
-            "kind",
-            "minimum",
-            "maximum",
-            "integer",
-        ]);
-        return {
-            key: stableKey(row.key, `${itemLabel}.key`),
-            kind: literal(row.kind, ["bounded_number"], `${itemLabel}.kind`),
-            minimum: parseSymbolicSafeInteger(row.minimum, `${itemLabel}.minimum`),
-            maximum: parseSymbolicSafeInteger(row.maximum, `${itemLabel}.maximum`),
-            integer: parseLiteralBooleanTrue(row.integer, `${itemLabel}.integer`),
-        };
-    });
-}
-export function parseSymbolicPredicate(value, label) {
-    const operator = object(value, label, ["op"], [
-        "axis_ref",
-        "value",
-        "values",
-        "minimum",
-        "maximum",
-        "minimum_inclusive",
-        "maximum_inclusive",
-        "predicates",
-        "predicate",
-    ]).op;
-    if (operator === "eq")
-        return parseEquality(value, label);
-    if (operator === "in")
-        return parseMembership(value, label);
-    if (operator === "range")
-        return parseRange(value, label);
-    if (operator === "all" || operator === "any")
-        return parseGroup(value, label);
-    if (operator === "not")
-        return parseNegation(value, label);
-    throw new Error(`design_resource_symbolic_manifest_invalid:${label}.op:unknown:${String(operator)}`);
-}
-function parseEquality(value, label) {
-    const row = object(value, label, ["op", "axis_ref", "value"]);
-    return {
-        op: "eq",
-        axis_ref: stableKey(row.axis_ref, `${label}.axis_ref`),
-        value: parseSymbolicScalar(row.value, `${label}.value`),
-    };
-}
-function parseMembership(value, label) {
-    const row = object(value, label, ["op", "axis_ref", "values"]);
-    return {
-        op: "in",
-        axis_ref: stableKey(row.axis_ref, `${label}.axis_ref`),
-        values: array(row.values, `${label}.values`).map((entry, index) => parseSymbolicScalar(entry, `${label}.values[${index}]`)),
-    };
-}
-function parseRange(value, label) {
-    const row = object(value, label, [
-        "op",
-        "axis_ref",
-        "minimum",
-        "maximum",
-        "minimum_inclusive",
-        "maximum_inclusive",
-    ]);
-    return {
-        op: "range",
-        axis_ref: stableKey(row.axis_ref, `${label}.axis_ref`),
-        minimum: parseSymbolicSafeInteger(row.minimum, `${label}.minimum`),
-        maximum: parseSymbolicSafeInteger(row.maximum, `${label}.maximum`),
-        minimum_inclusive: boolean(row.minimum_inclusive, `${label}.minimum_inclusive`),
-        maximum_inclusive: boolean(row.maximum_inclusive, `${label}.maximum_inclusive`),
-    };
-}
-function parseGroup(value, label) {
-    const row = object(value, label, ["op", "predicates"]);
-    return {
-        op: literal(row.op, ["all", "any"], `${label}.op`),
-        predicates: array(row.predicates, `${label}.predicates`).map((entry, index) => parseSymbolicPredicate(entry, `${label}.predicates[${index}]`)),
-    };
-}
-function parseNegation(value, label) {
-    const row = object(value, label, ["op", "predicate"]);
-    return {
-        op: "not",
-        predicate: parseSymbolicPredicate(row.predicate, `${label}.predicate`),
-    };
-}
-export function parseSymbolicScalar(value, label) {
-    if (typeof value === "string")
-        return stableKey(value, label);
-    return parseSymbolicSafeInteger(value, label);
-}
-export function parseSymbolicSafeInteger(value, label) {
-    if (typeof value !== "number" || !Number.isSafeInteger(value))
-        throw new Error(`design_resource_symbolic_manifest_invalid:${label}:safe_integer_required`);
-    return value;
-}
-export function parseSymbolicNonnegativeInteger(value, label) {
-    const parsed = parseSymbolicSafeInteger(value, label);
-    if (parsed < 0)
-        throw new Error(`design_resource_symbolic_manifest_invalid:${label}:nonnegative_required`);
-    return parsed;
-}
-function parseLiteralBooleanTrue(value, label) {
-    if (boolean(value, label) !== true)
-        throw new Error(`design_resource_symbolic_manifest_invalid:${label}:must_be_true`);
-    return true;
-}

package/dist/lib/design-resource-symbolic-production-closure.d.ts

@@ -1,4 +0,0 @@
-import { Buffer } from "node:buffer";
-import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
-import type { DesignResourceSymbolicHandoffTargetV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceFailureWitnessV1 } from "./design-resource-symbolic-fact-types.js";
-export declare function productionClosureFailure(target: DesignResourceSymbolicHandoffTargetV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>): DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;

package/dist/lib/design-resource-symbolic-production-closure.js

@@ -1,144 +0,0 @@
-import { Buffer } from "node:buffer";
-import { symbolicNoninterferenceCertificateScopeSha256 } from "./design-resource-symbolic-noninterference-scope.js";
-import { DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE } from "./design-resource-symbolic-source-ir-types.js";
-import { canonicalJson } from "./strict-codec.js";
-const SAFE_STATIC_HTML_TAGS = new Set([
-    "article",
-    "aside",
-    "body",
-    "br",
-    "div",
-    "footer",
-    "h1",
-    "h2",
-    "h3",
-    "h4",
-    "h5",
-    "h6",
-    "head",
-    "header",
-    "html",
-    "li",
-    "main",
-    "nav",
-    "ol",
-    "p",
-    "section",
-    "span",
-    "strong",
-    "ul",
-]);
-const SAFE_STATIC_HTML_ATTRIBUTE = /^(?:aria-[a-z0-9-]+|class|data-[a-z0-9-]+|dir|id|lang|role|title)$/u;
-const HTML_TOKEN = /<!doctype\s+html\s*>|<\/?[A-Za-z][A-Za-z0-9]*\b[^<>]*>/giu;
-const HTML_TAG = /^<(\/)?([A-Za-z][A-Za-z0-9]*)([^<>]*)>$/u;
-const HTML_ATTRIBUTE = /\s+([A-Za-z_:][A-Za-z0-9_.:-]*)(?:\s*=\s*(?:"[^"]*"|'[^']*'))?/guy;
-export function productionClosureFailure(target, certificate, resources, contents) {
-    for (const resourceRef of target.resource_refs) {
-        const resource = resources.get(resourceRef);
-        const bytes = contents.get(resourceRef);
-        if (!resource || !bytes)
-            continue;
-        if (resourceRef === target.source_profile.entry_resource_ref) {
-            if (resource.media_type !== "text/html")
-                return witness(certificate, resource, null, `unsupported_entry_media:${resource.media_type}`);
-            const failure = staticHtmlFailure(bytes.toString("utf8"));
-            if (failure)
-                return witness(certificate, resource, failure.offset, failure.detail, bytes.toString("utf8"));
-            continue;
-        }
-        if (resource.media_type !== "application/json" &&
-            resource.media_type !== DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE)
-            return witness(certificate, resource, null, `unsupported_dependency_media:${resource.media_type}`);
-        try {
-            const parsed = JSON.parse(bytes.toString("utf8"));
-            if (resource.media_type === DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE &&
-                canonicalJson(parsed) !== bytes.toString("utf8"))
-                return witness(certificate, resource, null, "noncanonical_symbolic_source_ir");
-        }
-        catch {
-            return witness(certificate, resource, null, "invalid_inert_json");
-        }
-    }
-    return null;
-}
-function staticHtmlFailure(source) {
-    let cursor = 0;
-    let doctypeSeen = false;
-    for (const match of source.matchAll(HTML_TOKEN)) {
-        const token = match[0];
-        const offset = match.index;
-        if (source.slice(cursor, offset).includes("<"))
-            return {
-                offset: cursor + source.slice(cursor, offset).indexOf("<"),
-                detail: "unsupported_html_token",
-            };
-        cursor = offset + token.length;
-        if (/^<!doctype/iu.test(token)) {
-            if (doctypeSeen || source.slice(0, offset).trim())
-                return { offset, detail: "misplaced_or_duplicate_doctype" };
-            doctypeSeen = true;
-            continue;
-        }
-        const parsed = HTML_TAG.exec(token);
-        if (!parsed)
-            return { offset, detail: "unsupported_html_token" };
-        const closing = parsed[1] === "/";
-        const tag = parsed[2].toLowerCase();
-        if (!SAFE_STATIC_HTML_TAGS.has(tag))
-            return { offset, detail: `unsupported_html_tag:${tag}` };
-        const attributes = parsed[3];
-        if (closing) {
-            if (attributes.trim())
-                return { offset, detail: "closing_tag_attributes" };
-            continue;
-        }
-        const attributeFailure = staticAttributeFailure(attributes);
-        if (attributeFailure)
-            return {
-                offset: offset + token.indexOf(attributes) + attributeFailure.offset,
-                detail: attributeFailure.detail,
-            };
-    }
-    const remainder = source.slice(cursor);
-    if (remainder.includes("<"))
-        return {
-            offset: cursor + remainder.indexOf("<"),
-            detail: "unsupported_html_token",
-        };
-    return null;
-}
-function staticAttributeFailure(source) {
-    const value = source.endsWith("/") ? source.slice(0, -1) : source;
-    let cursor = 0;
-    HTML_ATTRIBUTE.lastIndex = 0;
-    while (cursor < value.length) {
-        HTML_ATTRIBUTE.lastIndex = cursor;
-        const match = HTML_ATTRIBUTE.exec(value);
-        if (!match || match.index !== cursor)
-            return { offset: cursor, detail: "unsupported_html_attribute_syntax" };
-        const name = match[1].toLowerCase();
-        if (!SAFE_STATIC_HTML_ATTRIBUTE.test(name))
-            return { offset: cursor, detail: `unsupported_html_attribute:${name}` };
-        cursor = HTML_ATTRIBUTE.lastIndex;
-    }
-    return null;
-}
-function witness(certificate, resource, byteOffset, detail, source = "") {
-    const axisRef = certificate.omitted_axis_refs.find((axis) => source.includes(axis));
-    return {
-        kind: axisRef ? "omitted_axis_dependency" : "unsupported_dependency",
-        side: "production",
-        certificate_scope_sha256: symbolicNoninterferenceCertificateScopeSha256(certificate),
-        axis_ref: axisRef ?? null,
-        fact_rule_ref: null,
-        resource_ref: resource.key,
-        path: resource.path,
-        locator: null,
-        node_ref: null,
-        byte_offset: byteOffset === null
-            ? null
-            : Buffer.byteLength(source.slice(0, byteOffset)),
-        assignment: null,
-        detail,
-    };
-}