project-tiny-context-harness 0.11.0 → 0.12.0

package/dist/lib/long-task-explain-claim-links.d.ts

@@ -1,47 +0,0 @@
-import type { ClaimCoverageSummaryV2, DeliveryContractV2, SourceClaimV2 } from "./long-task-delivery-types.js";
-type ClaimDisposition = Extract<SourceClaimV2["disposition"], {
-    type: "claim";
-}>;
-type GlobalDisposition = Extract<SourceClaimV2["disposition"], {
-    type: "global_constraint";
-}>;
-type ResultDisposition = Extract<SourceClaimV2["disposition"], {
-    type: "outcome_result";
-}>;
-export declare function explainOutcomeClaimLinks(contract: DeliveryContractV2, coverage: ClaimCoverageSummaryV2, disposition: ClaimDisposition): {
-    type: "claim";
-    reference: string;
-    source_backed: boolean;
-    checks: string[];
-    assertions: (string | null)[];
-    required_proof_surfaces: import("./long-task-contract-types.js").ProofSurface[];
-    covered_proof_surfaces: import("./long-task-contract-types.js").ProofSurface[];
-    evidence_adapters: (import("./long-task-evidence-adapter-types.js").EvidenceAdapter | null)[];
-}[];
-export declare function explainOutcomeResultLinks(contract: DeliveryContractV2, coverage: ClaimCoverageSummaryV2, disposition: ResultDisposition): {
-    type: "outcome_result";
-    reference: string;
-    source_backed: boolean;
-    checks: string[];
-}[];
-export declare function explainGlobalClaimLinks(contract: DeliveryContractV2, coverage: ClaimCoverageSummaryV2, disposition: GlobalDisposition): {
-    type: "global_constraint";
-    reference: string;
-    source_backed: boolean;
-    checks: string[];
-    assertions: (string | null)[];
-    evidence_adapters: (import("./long-task-evidence-adapter-types.js").EvidenceAdapter | null)[];
-    counterfactuals: {
-        key: string;
-        check_key: string;
-        binding_ref: string;
-        owning_outcome: string;
-        owner_paths: string[];
-        carrier_paths: string[];
-        expected_assertion_failures: string[];
-        preserved_assertions: string[];
-        allowed_fanout_assertions: string[];
-        mutation: import("./long-task-counterfactual-types.js").CounterfactualMutationV2;
-    }[];
-}[];
-export {};

package/dist/lib/long-task-explain-claim-links.js

@@ -1,90 +0,0 @@
-import { evidenceAdapterForRunner } from "./long-task-evidence-adapter-policy.js";
-export function explainOutcomeClaimLinks(contract, coverage, disposition) {
-    return disposition.refs.map((reference) => {
-        const [outcomeKey, ...parts] = reference.split(".");
-        const proof = coverage.claims_by_outcome[outcomeKey]?.[parts.join(".")];
-        return {
-            type: disposition.type,
-            reference,
-            source_backed: sourceBacked(contract, reference),
-            checks: proof ? unique(proof.proofs.map((item) => item.check_key)) : [],
-            assertions: proof
-                ? unique(proof.proofs.map((item) => item.assertion_key))
-                : [],
-            required_proof_surfaces: proof ? proof.required_surfaces : [],
-            covered_proof_surfaces: proof ? proof.covered_surfaces : [],
-            evidence_adapters: proof
-                ? unique(proof.proofs.map((item) => outcomeAdapter(contract, outcomeKey, item.check_key)))
-                : [],
-        };
-    });
-}
-export function explainOutcomeResultLinks(contract, coverage, disposition) {
-    const proof = coverage.claims_by_outcome[disposition.ref.split(".")[0]]?.result;
-    return [
-        {
-            type: disposition.type,
-            reference: disposition.ref,
-            source_backed: sourceBacked(contract, disposition.ref),
-            checks: proof ? unique(proof.proofs.map((item) => item.check_key)) : [],
-        },
-    ];
-}
-export function explainGlobalClaimLinks(contract, coverage, disposition) {
-    return disposition.refs.map((reference) => {
-        const proof = coverage.claims_by_global[reference];
-        return {
-            type: disposition.type,
-            reference,
-            source_backed: sourceBacked(contract, reference),
-            checks: proof ? unique(proof.proofs.map((item) => item.check_key)) : [],
-            assertions: proof
-                ? unique(proof.proofs.map((item) => item.assertion_key))
-                : [],
-            evidence_adapters: proof
-                ? unique(proof.proofs.map((item) => globalAdapter(contract, item.check_key)))
-                : [],
-            counterfactuals: contract.global.acceptance.counterfactual_controls
-                .filter((control) => control.claims.includes(reference))
-                .map((control) => {
-                const [outcomeKey, bindingKey] = control.binding_ref.split(".");
-                const outcome = contract.outcomes.find((item) => item.key === outcomeKey);
-                const binding = outcome?.technical.bindings.find((item) => item.key === bindingKey);
-                return {
-                    key: control.key,
-                    check_key: control.check_key,
-                    binding_ref: control.binding_ref,
-                    owning_outcome: outcomeKey,
-                    owner_paths: outcome?.product.owner.path_globs ?? [],
-                    carrier_paths: binding?.carrier_paths ?? [],
-                    expected_assertion_failures: control.expected_assertion_failures,
-                    preserved_assertions: control.preserved_assertions,
-                    allowed_fanout_assertions: control.allowed_fanout_assertions,
-                    mutation: control.mutation,
-                };
-            }),
-        };
-    });
-}
-function unique(values) {
-    return values.filter((value, index) => values.indexOf(value) === index);
-}
-function sourceBacked(contract, reference) {
-    return contract.source_claims.some((source) => {
-        const disposition = source.disposition;
-        if (disposition.type === "outcome_result")
-            return disposition.ref === reference;
-        return ((disposition.type === "claim" ||
-            disposition.type === "global_constraint") &&
-            disposition.refs.includes(reference));
-    });
-}
-function outcomeAdapter(contract, outcomeKey, checkKey) {
-    const outcome = contract.outcomes.find((item) => item.key === outcomeKey);
-    const check = outcome?.acceptance.checks.find((candidate) => candidate.key === checkKey);
-    return check ? evidenceAdapterForRunner(check.runner.type) : null;
-}
-function globalAdapter(contract, checkKey) {
-    const check = contract.global.acceptance.checks.find((candidate) => candidate.key === checkKey);
-    return check ? evidenceAdapterForRunner(check.runner.type) : null;
-}

package/dist/lib/long-task-explain-source-links.d.ts

@@ -1,99 +0,0 @@
-import type { ClaimCoverageSummaryV2, DeliveryContractV2, SourceClaimV2 } from "./long-task-delivery-types.js";
-export declare function explainSourceLinks(contract: DeliveryContractV2, coverage: ClaimCoverageSummaryV2, source: SourceClaimV2): ({
-    type: "acceptance" | "claim" | "decision_required" | "external_confirmation" | "global_constraint" | "outcome_result" | "risk_fact";
-    reason: string | null;
-} | {
-    type: "acceptance";
-    reference: string;
-    scope: "global" | "outcome";
-    outcome_key: string | null;
-    criterion: string | null;
-    claims: string[];
-    source_backed_claims: string[];
-    required_proof_surfaces: Record<string, string[]>;
-    covered_proof_surfaces: Record<string, string[]>;
-    proof_surface: import("./long-task-contract-types.js").ProofSurface;
-    evidence_adapter: import("./long-task-evidence-adapter-types.js").EvidenceAdapter;
-    observation: string;
-    counterfactuals: {
-        key: string;
-        claims: string[];
-        binding_ref: string;
-        owning_outcome_key: string;
-        expected_assertion_failures: string[];
-        preserved_assertions: string[];
-        allowed_fanout_assertions: string[];
-    }[] | {
-        key: string;
-        claims: string[];
-        binding_key: string;
-        owning_outcome_key: string | null;
-        expected_assertion_failures: string[];
-        preserved_assertions: string[];
-        allowed_fanout_assertions: string[];
-    }[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: string;
-    reference: string;
-    scope: null;
-    outcome_key: null;
-    criterion: null;
-    claims: never[];
-    source_backed_claims: never[];
-    required_proof_surfaces: {};
-    covered_proof_surfaces: {};
-    proof_surface: null;
-    evidence_adapter: null;
-    observation: null;
-    counterfactuals: never[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "claim";
-    reference: string;
-    source_backed: boolean;
-    checks: string[];
-    assertions: (string | null)[];
-    required_proof_surfaces: import("./long-task-contract-types.js").ProofSurface[];
-    covered_proof_surfaces: import("./long-task-contract-types.js").ProofSurface[];
-    evidence_adapters: (import("./long-task-evidence-adapter-types.js").EvidenceAdapter | null)[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "outcome_result";
-    reference: string;
-    source_backed: boolean;
-    checks: string[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "global_constraint";
-    reference: string;
-    source_backed: boolean;
-    checks: string[];
-    assertions: (string | null)[];
-    evidence_adapters: (import("./long-task-evidence-adapter-types.js").EvidenceAdapter | null)[];
-    counterfactuals: {
-        key: string;
-        check_key: string;
-        binding_ref: string;
-        owning_outcome: string;
-        owner_paths: string[];
-        carrier_paths: string[];
-        expected_assertion_failures: string[];
-        preserved_assertions: string[];
-        allowed_fanout_assertions: string[];
-        mutation: import("./long-task-counterfactual-types.js").CounterfactualMutationV2;
-    }[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "external_confirmation";
-    reference: string;
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-} | {
-    type: "risk_fact";
-    reference: string;
-    risk_fact: string;
-    affected_outcome: string;
-    effective_risk: import("./long-task-risk-types.js").EffectiveRiskLevel;
-    risk_reasons: ("critical_user_path" | "data_migration" | "full_population_operation" | "irreversible_external_effect" | "multi_repository_change" | "permission_boundary_change" | "persistent_data_change" | "public_api_or_schema_change" | "security_boundary_change" | "weak_observability")[];
-    canonical_target: import("./long-task-source-target-index.js").CanonicalSourceTarget | null;
-})[];

package/dist/lib/long-task-explain-source-links.js

@@ -1,51 +0,0 @@
-import { explainAcceptanceLinks } from "./long-task-explain-acceptance-link.js";
-import { explainGlobalClaimLinks, explainOutcomeClaimLinks, explainOutcomeResultLinks, } from "./long-task-explain-claim-links.js";
-import { buildCanonicalSourceTargetIndex } from "./long-task-source-target-index.js";
-import { classifyLongTaskRisk } from "./long-task-risk.js";
-export function explainSourceLinks(contract, coverage, source) {
-    const disposition = source.disposition;
-    const targets = buildCanonicalSourceTargetIndex(contract);
-    let links;
-    if (disposition.type === "acceptance")
-        links = explainAcceptanceLinks(contract, coverage, disposition);
-    if (disposition.type === "claim")
-        links = explainOutcomeClaimLinks(contract, coverage, disposition);
-    if (disposition.type === "outcome_result")
-        links = explainOutcomeResultLinks(contract, coverage, disposition);
-    if (disposition.type === "global_constraint")
-        links = explainGlobalClaimLinks(contract, coverage, disposition);
-    if (disposition.type === "external_confirmation")
-        links = disposition.refs.map((reference) => ({
-            type: disposition.type,
-            reference,
-        }));
-    if (disposition.type === "risk_fact") {
-        const risk = classifyLongTaskRisk(contract);
-        links = disposition.refs.map((reference) => {
-            const [fact, affectedOutcome] = reference.split(":");
-            return {
-                type: disposition.type,
-                reference,
-                risk_fact: fact,
-                affected_outcome: affectedOutcome,
-                effective_risk: risk.effective_level,
-                risk_reasons: risk.reasons_by_outcome[affectedOutcome] ?? [],
-            };
-        });
-    }
-    links ??= [
-        {
-            type: disposition.type,
-            reason: "reason" in disposition ? disposition.reason : null,
-        },
-    ];
-    return links.map((link) => {
-        if (!("reference" in link))
-            return link;
-        const target = targets.get(link.reference);
-        return {
-            ...link,
-            canonical_target: target ?? null,
-        };
-    });
-}

package/dist/lib/long-task-external-confirmation-artifacts.d.ts

@@ -1,9 +0,0 @@
-import type { ExternalConfirmationRecordV2 } from "./long-task-external-confirmation-types.js";
-export declare const MAX_TOTAL_EXTERNAL_CONFIRMATION_ARTIFACT_BYTES: number;
-export declare function externalConfirmationArtifactStoreRef(sha256: string): string;
-export declare function captureAndStoreExternalConfirmationArtifacts(repository: string, workdir: string, snapshots: ExternalConfirmationRecordV2["artifact_snapshots"], options?: {
-    max_total_bytes?: number;
-}): Promise<void>;
-export declare function externalArtifactSnapshotIntegrityIssues(repository: string, workdir: string, snapshots: ExternalConfirmationRecordV2["artifact_snapshots"]): Promise<string[]>;
-export declare function captureStoredExternalConfirmationArtifactIdentities(repository: string, workdir: string, snapshots: ExternalConfirmationRecordV2["artifact_snapshots"]): Promise<Record<string, string>>;
-export declare function externalArtifactIntegrityIssues(repository: string, artifacts: Record<string, string>): Promise<string[]>;

package/dist/lib/long-task-external-confirmation-artifacts.js

@@ -1,138 +0,0 @@
-import { lstat, open, readFile, rename, rm } from "node:fs/promises";
-import path from "node:path";
-import { assertProtectedRepositoryFile, assertSafeRepositoryFilePath, ensureSafeRepositoryDirectory, } from "./repository-path-safety.js";
-import { runtimePath } from "./long-task-state.js";
-import { sha256Hex } from "./strict-codec.js";
-const ARTIFACT_STORE_FOLDER = "external-confirmations/artifacts";
-const MAX_ARTIFACT_BYTES = 16 * 1024 * 1024;
-export const MAX_TOTAL_EXTERNAL_CONFIRMATION_ARTIFACT_BYTES = 64 * 1024 * 1024;
-export function externalConfirmationArtifactStoreRef(sha256) {
-    if (!/^[a-f0-9]{64}$/u.test(sha256))
-        throw new Error(`external_confirmation_artifact_hash_invalid:${sha256}`);
-    return `${ARTIFACT_STORE_FOLDER}/${sha256}`;
-}
-export async function captureAndStoreExternalConfirmationArtifacts(repository, workdir, snapshots, options = {}) {
-    const captured = [];
-    let totalBytes = 0;
-    for (const [evidenceRef, snapshot] of Object.entries(snapshots).sort(([left], [right]) => left.localeCompare(right))) {
-        const expectedStoreRef = externalConfirmationArtifactStoreRef(snapshot.sha256);
-        if (snapshot.store_ref !== expectedStoreRef)
-            throw new Error(`external_confirmation_artifact_store_ref_mismatch:${evidenceRef}`);
-        if (evidenceRef.startsWith(`${ARTIFACT_STORE_FOLDER}/`))
-            throw new Error(`external_confirmation_artifact_source_store_ref_not_allowed:${evidenceRef}`);
-        const file = await assertProtectedRepositoryFile(repository, path.resolve(repository, ...evidenceRef.split("/")), `external_confirmation_artifact:${evidenceRef}`);
-        const info = await lstat(file);
-        if (info.size > MAX_ARTIFACT_BYTES)
-            throw new Error(`external_confirmation_artifact_too_large:${evidenceRef}:${info.size}`);
-        totalBytes += info.size;
-        if (totalBytes >
-            (options.max_total_bytes ??
-                MAX_TOTAL_EXTERNAL_CONFIRMATION_ARTIFACT_BYTES))
-            throw new Error(`external_confirmation_artifacts_total_too_large:${totalBytes}`);
-        const bytes = await readFile(file);
-        if (bytes.length !== info.size || bytes.length !== snapshot.size_bytes)
-            throw new Error(`external_confirmation_artifact_size_mismatch:${evidenceRef}`);
-        if (sha256Hex(bytes) !== snapshot.sha256)
-            throw new Error(`external_confirmation_artifact_content_mismatch:${evidenceRef}`);
-        captured.push({ sha256: snapshot.sha256, bytes });
-    }
-    const unique = new Map(captured.map((row) => [row.sha256, row.bytes]));
-    for (const [sha256, bytes] of unique)
-        await storeArtifact(repository, workdir, sha256, bytes);
-}
-export async function externalArtifactSnapshotIntegrityIssues(repository, workdir, snapshots) {
-    const issues = [];
-    for (const [evidenceRef, snapshot] of Object.entries(snapshots).sort(([left], [right]) => left.localeCompare(right))) {
-        const expectedStoreRef = externalConfirmationArtifactStoreRef(snapshot.sha256);
-        if (snapshot.store_ref !== expectedStoreRef) {
-            issues.push(`artifact_store_ref_mismatch:${evidenceRef}`);
-            continue;
-        }
-        try {
-            const file = await assertProtectedRepositoryFile(repository, runtimePath(workdir, snapshot.store_ref), `external_confirmation_artifact_snapshot:${evidenceRef}`);
-            const info = await lstat(file);
-            const bytes = await readFile(file);
-            if (info.size !== snapshot.size_bytes ||
-                bytes.length !== snapshot.size_bytes)
-                issues.push(`artifact_snapshot_size_changed:${evidenceRef}`);
-            if (sha256Hex(bytes) !== snapshot.sha256)
-                issues.push(`artifact_snapshot_content_changed:${evidenceRef}`);
-        }
-        catch (error) {
-            issues.push(`artifact_snapshot_invalid:${evidenceRef}:${message(error)}`);
-        }
-    }
-    return issues;
-}
-export async function captureStoredExternalConfirmationArtifactIdentities(repository, workdir, snapshots) {
-    const result = {};
-    for (const snapshot of Object.values(snapshots).sort((left, right) => left.store_ref.localeCompare(right.store_ref)))
-        try {
-            const file = await assertProtectedRepositoryFile(repository, runtimePath(workdir, snapshot.store_ref), `external_confirmation_artifact_snapshot:${snapshot.store_ref}`);
-            result[snapshot.store_ref] = `sha256:${sha256Hex(await readFile(file))}`;
-        }
-        catch (error) {
-            result[snapshot.store_ref] = `unavailable:${sha256Hex(`${snapshot.sha256}\0${message(error)}`)}`;
-        }
-    return result;
-}
-// Legacy v1 audit helper. It never establishes fulfillment.
-export async function externalArtifactIntegrityIssues(repository, artifacts) {
-    const issues = [];
-    for (const [relative, expectedHash] of Object.entries(artifacts)) {
-        try {
-            const file = await assertProtectedRepositoryFile(repository, path.resolve(repository, ...relative.split("/")), `external_confirmation_artifact:${relative}`);
-            const actualHash = sha256Hex(await readFile(file));
-            if (actualHash !== expectedHash)
-                issues.push(`artifact_content_changed:${relative}`);
-        }
-        catch (error) {
-            issues.push(`artifact_invalid:${relative}:${message(error)}`);
-        }
-    }
-    return issues;
-}
-async function storeArtifact(repository, workdir, sha256, bytes) {
-    const storeRef = externalConfirmationArtifactStoreRef(sha256);
-    const folder = runtimePath(workdir, ARTIFACT_STORE_FOLDER);
-    await ensureSafeRepositoryDirectory(repository, repositoryRelative(repository, folder), "external_confirmation_artifact_store");
-    const target = runtimePath(workdir, storeRef);
-    const safe = await assertSafeRepositoryFilePath(repository, repositoryRelative(repository, target), `external_confirmation_artifact_store:${sha256}`, { destinationMayBeAbsent: true });
-    if (safe.status) {
-        const existing = await readFile(safe.absolute);
-        if (sha256Hex(existing) !== sha256 || existing.length !== bytes.length)
-            throw new Error(`external_confirmation_artifact_store_collision:${sha256}`);
-        return;
-    }
-    const temporary = `${target}.tmp-${process.pid}-${Date.now()}`;
-    const handle = await open(temporary, "wx");
-    try {
-        await handle.writeFile(bytes);
-        await handle.sync();
-    }
-    catch (error) {
-        await handle.close().catch(() => undefined);
-        await rm(temporary, { force: true });
-        throw error;
-    }
-    await handle.close();
-    try {
-        await rename(temporary, target);
-    }
-    catch (error) {
-        await rm(temporary, { force: true });
-        throw error;
-    }
-}
-function repositoryRelative(repository, candidate) {
-    const relative = path.relative(path.resolve(repository), path.resolve(candidate));
-    if (!relative ||
-        relative === ".." ||
-        relative.startsWith(`..${path.sep}`) ||
-        path.isAbsolute(relative))
-        throw new Error("external_confirmation_artifact_outside_repository");
-    return relative.replace(/\\/gu, "/");
-}
-function message(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/lib/long-task-external-confirmation-attestation.d.ts

@@ -1,20 +0,0 @@
-import type { CompiledExternalConfirmationIdentityAssuranceV2, DeliveryContractV2, ExternalConfirmationV2 } from "./long-task-contract-types.js";
-import type { CompiledDeliveryContractV2, ContextAuthoritySnapshotV2 } from "./long-task-delivery-types.js";
-import type { ExternalConfirmationActorV1, ExternalConfirmationRecordV2 } from "./long-task-external-confirmation-types.js";
-export declare function compileExternalConfirmationIdentityAssurances(input: {
-    contract: DeliveryContractV2;
-    repository: string;
-    source_hashes: Record<string, string>;
-    context_snapshot: ContextAuthoritySnapshotV2;
-}): Promise<Record<string, CompiledExternalConfirmationIdentityAssuranceV2>>;
-export declare function externalConfirmationActor(confirmation: ExternalConfirmationV2): ExternalConfirmationActorV1 | null;
-export declare function compiledExternalConfirmationIdentityAssurance(compiled: CompiledDeliveryContractV2, confirmationRef: string): CompiledExternalConfirmationIdentityAssuranceV2 | null;
-export declare function verifyExternalConfirmationAttestation(input: {
-    repository: string;
-    confirmation_ref: string;
-    assurance: CompiledExternalConfirmationIdentityAssuranceV2 | null;
-    record: ExternalConfirmationRecordV2;
-}): Promise<{
-    verified: boolean;
-    issues: string[];
-}>;

package/dist/lib/long-task-external-confirmation-attestation.js

@@ -1,115 +0,0 @@
-import { createPublicKey, verify } from "node:crypto";
-import { readFile, stat } from "node:fs/promises";
-import path from "node:path";
-import { externalConfirmationV2SignablePayload } from "./long-task-external-confirmation-shape.js";
-import { normalizeContextAuthoritySnapshot } from "./long-task-context-authority.js";
-import { assertProtectedRepositoryFile } from "./repository-path-safety.js";
-import { sha256Hex } from "./strict-codec.js";
-const MAX_PUBLIC_KEY_BYTES = 64 * 1024;
-export async function compileExternalConfirmationIdentityAssurances(input) {
-    const result = {};
-    const context = normalizeContextAuthoritySnapshot(input.context_snapshot);
-    const controllingContext = new Set(context.controlling_files);
-    for (const confirmation of input.contract.global.acceptance
-        .external_confirmations) {
-        const assurance = confirmation.actor?.identity_assurance;
-        if (!assurance)
-            continue;
-        if (assurance.scheme === "declared_only") {
-            result[confirmation.key] = assurance;
-            continue;
-        }
-        const expectedHash = input.source_hashes[assurance.public_key_ref] ??
-            (controllingContext.has(assurance.public_key_ref)
-                ? context.sha256[assurance.public_key_ref]
-                : undefined);
-        if (!expectedHash)
-            throw new Error(`external_confirmation_public_key_not_controlling_source:${confirmation.key}:${assurance.public_key_ref}`);
-        const file = await assertProtectedRepositoryFile(input.repository, path.resolve(input.repository, ...assurance.public_key_ref.split("/")), `external_confirmation_public_key:${confirmation.key}`);
-        const info = await stat(file);
-        if (info.size > MAX_PUBLIC_KEY_BYTES)
-            throw new Error(`external_confirmation_public_key_too_large:${confirmation.key}:${info.size}`);
-        const bytes = await readFile(file);
-        const actualHash = sha256Hex(bytes);
-        if (actualHash !== expectedHash)
-            throw new Error(`external_confirmation_public_key_identity_mismatch:${confirmation.key}`);
-        assertEd25519PublicKey(bytes, confirmation.key);
-        result[confirmation.key] = {
-            ...assurance,
-            public_key_sha256: actualHash,
-        };
-    }
-    return Object.fromEntries(Object.entries(result).sort(([left], [right]) => left.localeCompare(right)));
-}
-export function externalConfirmationActor(confirmation) {
-    if (!confirmation.actor)
-        return null;
-    return {
-        id: confirmation.actor.id,
-        role: confirmation.actor.role,
-        authority_kind: confirmation.actor.authority_kind,
-    };
-}
-export function compiledExternalConfirmationIdentityAssurance(compiled, confirmationRef) {
-    return (compiled.external_confirmation_identity_assurances?.[confirmationRef] ??
-        null);
-}
-export async function verifyExternalConfirmationAttestation(input) {
-    const issues = [];
-    const assurance = input.assurance;
-    if (!assurance || assurance.scheme !== "ed25519")
-        return {
-            verified: false,
-            issues: ["blocking_actor_identity_not_ed25519"],
-        };
-    if (input.record.attestation.scheme !== assurance.scheme)
-        issues.push("attestation_scheme_mismatch");
-    if (input.record.attestation.key_id !== assurance.key_id)
-        issues.push("attestation_key_id_mismatch");
-    let publicKeyBytes;
-    try {
-        const file = await assertProtectedRepositoryFile(input.repository, path.resolve(input.repository, ...assurance.public_key_ref.split("/")), `external_confirmation_public_key:${input.confirmation_ref}`);
-        const info = await stat(file);
-        if (info.size > MAX_PUBLIC_KEY_BYTES)
-            throw new Error(`public_key_too_large:${info.size}`);
-        publicKeyBytes = await readFile(file);
-        if (sha256Hex(publicKeyBytes) !== assurance.public_key_sha256)
-            issues.push("public_key_identity_stale");
-    }
-    catch (error) {
-        issues.push(`public_key_invalid:${message(error)}`);
-        return { verified: false, issues };
-    }
-    if (issues.length)
-        return { verified: false, issues };
-    try {
-        const key = assertEd25519PublicKey(publicKeyBytes, input.confirmation_ref);
-        const signature = Buffer.from(input.record.attestation.signature_base64, "base64");
-        const verified = verify(null, Buffer.from(externalConfirmationV2SignablePayload(input.record), "utf8"), key, signature);
-        return {
-            verified,
-            issues: verified ? [] : ["attestation_signature_invalid"],
-        };
-    }
-    catch (error) {
-        return {
-            verified: false,
-            issues: [`attestation_verification_failed:${message(error)}`],
-        };
-    }
-}
-function assertEd25519PublicKey(bytes, confirmationRef) {
-    let key;
-    try {
-        key = createPublicKey(bytes);
-    }
-    catch (error) {
-        throw new Error(`external_confirmation_public_key_invalid:${confirmationRef}:${message(error)}`);
-    }
-    if (key.type !== "public" || key.asymmetricKeyType !== "ed25519")
-        throw new Error(`external_confirmation_public_key_not_ed25519:${confirmationRef}`);
-    return key;
-}
-function message(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/lib/long-task-external-confirmation-challenge.d.ts

@@ -1,23 +0,0 @@
-import type { CompiledDeliveryContractV2 } from "./long-task-delivery-types.js";
-export interface ExternalConfirmationChallengeV1 {
-    schema_version: "long-task-external-confirmation-challenge-v1";
-    confirmation_ref: string;
-    compiled_identity: string;
-    authority_revision: number;
-    challenge: string;
-    rotated_at: string;
-    challenge_state_sha256: string;
-}
-export interface ExternalConfirmationChallengeContext {
-    repository: string;
-    workdir: string;
-    compiled: Pick<CompiledDeliveryContractV2, "compiled_identity" | "authority_revision">;
-}
-export declare function externalConfirmationChallengePath(workdir: string, confirmationRef: string): string;
-export declare function readOrCreateExternalConfirmationChallenge(context: ExternalConfirmationChallengeContext, confirmationRef: string): Promise<ExternalConfirmationChallengeV1>;
-export declare function rotateExternalConfirmationChallenge(context: ExternalConfirmationChallengeContext, confirmationRef: string): Promise<ExternalConfirmationChallengeV1>;
-export declare function readExternalConfirmationChallenge(repository: string, workdir: string, confirmationRef: string): Promise<{
-    challenge: ExternalConfirmationChallengeV1 | null;
-    error: string | null;
-}>;
-export declare function captureStoredExternalConfirmationChallengeIdentities(repository: string, workdir: string, confirmationRefs: readonly string[]): Promise<Record<string, string>>;