project-tiny-context-harness 0.11.0 → 0.12.0

package/dist/lib/long-task-external-confirmation-challenge.js

@@ -1,164 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { lstat, open, readFile, rename, rm } from "node:fs/promises";
-import path from "node:path";
-import { assertProtectedRepositoryFile, assertSafeRepositoryFilePath, ensureSafeRepositoryDirectory, } from "./repository-path-safety.js";
-import { runtimePath } from "./long-task-state.js";
-import { canonicalJson, canonicalValueJson, sha256Hex, } from "./strict-codec.js";
-const CHALLENGE_FOLDER = "external-confirmations/challenges";
-const MAX_CHALLENGE_RECORD_BYTES = 16 * 1024;
-const HASH = /^[a-f0-9]{64}$/u;
-const CHALLENGE = /^[A-Za-z0-9_-]{43}$/u;
-export function externalConfirmationChallengePath(workdir, confirmationRef) {
-    assertConfirmationKey(confirmationRef);
-    return runtimePath(workdir, `${CHALLENGE_FOLDER}/${confirmationRef}.json`);
-}
-export async function readOrCreateExternalConfirmationChallenge(context, confirmationRef) {
-    const current = await readExternalConfirmationChallenge(context.repository, context.workdir, confirmationRef);
-    if (current.error)
-        throw new Error(`external_confirmation_challenge_invalid:${confirmationRef}:${current.error}`);
-    if (current.challenge &&
-        current.challenge.compiled_identity ===
-            context.compiled.compiled_identity &&
-        current.challenge.authority_revision === context.compiled.authority_revision)
-        return current.challenge;
-    return rotateExternalConfirmationChallenge(context, confirmationRef);
-}
-export async function rotateExternalConfirmationChallenge(context, confirmationRef) {
-    const unsigned = {
-        schema_version: "long-task-external-confirmation-challenge-v1",
-        confirmation_ref: confirmationRef,
-        compiled_identity: context.compiled.compiled_identity,
-        authority_revision: context.compiled.authority_revision,
-        challenge: randomBytes(32).toString("base64url"),
-        rotated_at: new Date().toISOString(),
-    };
-    const record = parseChallenge({
-        ...unsigned,
-        challenge_state_sha256: sha256Hex(canonicalValueJson(unsigned)),
-    });
-    await writeChallenge(context.repository, context.workdir, record);
-    return record;
-}
-export async function readExternalConfirmationChallenge(repository, workdir, confirmationRef) {
-    const file = externalConfirmationChallengePath(workdir, confirmationRef);
-    const status = await lstat(file).catch((error) => {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    });
-    if (!status)
-        return { challenge: null, error: null };
-    try {
-        const protectedFile = await assertProtectedRepositoryFile(repository, file, `external_confirmation_challenge:${confirmationRef}`);
-        if (status.size > MAX_CHALLENGE_RECORD_BYTES)
-            throw new Error(`challenge_record_too_large:${status.size}`);
-        return {
-            challenge: parseChallenge(JSON.parse(await readFile(protectedFile, "utf8"))),
-            error: null,
-        };
-    }
-    catch (error) {
-        return { challenge: null, error: message(error) };
-    }
-}
-export async function captureStoredExternalConfirmationChallengeIdentities(repository, workdir, confirmationRefs) {
-    const result = {};
-    for (const confirmationRef of [...new Set(confirmationRefs)].sort()) {
-        const file = externalConfirmationChallengePath(workdir, confirmationRef);
-        const status = await lstat(file).catch((error) => {
-            if (error.code === "ENOENT")
-                return null;
-            throw error;
-        });
-        if (!status) {
-            result[confirmationRef] = "absent";
-            continue;
-        }
-        const protectedFile = await assertProtectedRepositoryFile(repository, file, `external_confirmation_challenge:${confirmationRef}`);
-        result[confirmationRef] =
-            `sha256:${sha256Hex(await readFile(protectedFile))}`;
-    }
-    return result;
-}
-async function writeChallenge(repository, workdir, record) {
-    const file = externalConfirmationChallengePath(workdir, record.confirmation_ref);
-    await ensureSafeRepositoryDirectory(repository, repositoryRelative(repository, path.dirname(file)), `external_confirmation_challenge_folder:${record.confirmation_ref}`);
-    await assertSafeRepositoryFilePath(repository, repositoryRelative(repository, file), `external_confirmation_challenge:${record.confirmation_ref}`, { destinationMayBeAbsent: true });
-    const temporary = `${file}.tmp-${process.pid}-${Date.now()}`;
-    const handle = await open(temporary, "wx");
-    try {
-        await handle.writeFile(canonicalJson(record), "utf8");
-        await handle.sync();
-    }
-    catch (error) {
-        await handle.close().catch(() => undefined);
-        await rm(temporary, { force: true });
-        throw error;
-    }
-    await handle.close();
-    try {
-        await rename(temporary, file);
-    }
-    catch (error) {
-        await rm(temporary, { force: true });
-        throw error;
-    }
-}
-function parseChallenge(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        throw new Error("challenge_record_not_object");
-    const row = value;
-    const expectedKeys = [
-        "schema_version",
-        "confirmation_ref",
-        "compiled_identity",
-        "authority_revision",
-        "challenge",
-        "rotated_at",
-        "challenge_state_sha256",
-    ];
-    const actualKeys = Object.keys(row).sort();
-    if (actualKeys.join("\0") !== [...expectedKeys].sort().join("\0"))
-        throw new Error("challenge_record_keys_invalid");
-    if (row.schema_version !== "long-task-external-confirmation-challenge-v1")
-        throw new Error("challenge_record_schema_invalid");
-    if (typeof row.confirmation_ref !== "string" ||
-        !/^[a-z0-9][a-z0-9-]*$/u.test(row.confirmation_ref))
-        throw new Error("challenge_confirmation_ref_invalid");
-    if (typeof row.compiled_identity !== "string" ||
-        !HASH.test(row.compiled_identity))
-        throw new Error("challenge_compiled_identity_invalid");
-    if (!Number.isSafeInteger(row.authority_revision) ||
-        row.authority_revision < 0)
-        throw new Error("challenge_authority_revision_invalid");
-    if (typeof row.challenge !== "string" || !CHALLENGE.test(row.challenge))
-        throw new Error("challenge_value_invalid");
-    if (typeof row.rotated_at !== "string" ||
-        !Number.isFinite(Date.parse(row.rotated_at)) ||
-        new Date(Date.parse(row.rotated_at)).toISOString() !== row.rotated_at)
-        throw new Error("challenge_timestamp_invalid");
-    if (typeof row.challenge_state_sha256 !== "string" ||
-        !HASH.test(row.challenge_state_sha256))
-        throw new Error("challenge_state_hash_invalid");
-    const record = row;
-    const { challenge_state_sha256: _hash, ...unsigned } = record;
-    if (sha256Hex(canonicalValueJson(unsigned)) !== record.challenge_state_sha256)
-        throw new Error("challenge_state_integrity_mismatch");
-    return record;
-}
-function repositoryRelative(repository, candidate) {
-    const relative = path.relative(path.resolve(repository), path.resolve(candidate));
-    if (!relative ||
-        relative === ".." ||
-        relative.startsWith(`..${path.sep}`) ||
-        path.isAbsolute(relative))
-        throw new Error("external_confirmation_challenge_outside_repository");
-    return relative.replace(/\\/gu, "/");
-}
-function assertConfirmationKey(value) {
-    if (!/^[a-z0-9][a-z0-9-]*$/u.test(value))
-        throw new Error(`external_confirmation_key_invalid:${value}`);
-}
-function message(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/lib/long-task-external-confirmation-context.d.ts

@@ -1,14 +0,0 @@
-import type { CompiledDeliveryContractV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
-import type { ExternalConfirmationCandidateV1, ExternalConfirmationRecord } from "./long-task-external-confirmation-types.js";
-import type { SemanticFactManifestV1 } from "./semantic-fact-types.js";
-export interface ExternalAuthorityContextV1 {
-    repository: string;
-    workdir: string;
-    compiled: CompiledDeliveryContractV2;
-    manifest: WorkspaceManifestV2;
-    candidate: ExternalConfirmationCandidateV1;
-    candidate_dirty: string[];
-    semantic_manifest: SemanticFactManifestV1;
-}
-export declare function loadExternalAuthorityContext(workdirInput: string, requireCleanCandidate: boolean): Promise<ExternalAuthorityContextV1>;
-export declare function readSubmittedExternalConfirmationRecord(recordPathInput: string): Promise<ExternalConfirmationRecord>;

package/dist/lib/long-task-external-confirmation-context.js

@@ -1,53 +0,0 @@
-import { lstat, readFile } from "node:fs/promises";
-import path from "node:path";
-import { parseExternalConfirmationRecord } from "./long-task-external-confirmation-shape.js";
-import { assertVerifierAuthorityCurrent, deliveryCompileFreshness, } from "./long-task-freshness.js";
-import { loadSemanticFactManifest } from "./semantic-fact-source-parser.js";
-import { assertMatchingActiveBinding, loadActiveLongTaskAuthority, } from "./long-task-state.js";
-import { captureWorkspaceManifest, currentGitState, repositoryRoot, } from "./long-task-workspace.js";
-const MAX_SUBMITTED_RECORD_BYTES = 16 * 1024 * 1024;
-export async function loadExternalAuthorityContext(workdirInput, requireCleanCandidate) {
-    const repository = await repositoryRoot(process.cwd());
-    const workdir = path.resolve(workdirInput);
-    const active = (await loadActiveLongTaskAuthority(repository, { migrate_legacy: true })).authority;
-    if (!active)
-        throw new Error("active_task_missing");
-    if (active.workdir !== workdir)
-        throw new Error("active_task_workdir_mismatch");
-    const compiled = active.authority_snapshot;
-    await assertMatchingActiveBinding(compiled);
-    await assertVerifierAuthorityCurrent(repository, active.verifier_identity);
-    const stale = await deliveryCompileFreshness(compiled);
-    if (stale.length)
-        throw new Error(`external_confirmation_authority_stale:${stale.join(",")}`);
-    const git = await currentGitState(repository);
-    if (requireCleanCandidate && git.dirty.length)
-        throw new Error(`external_confirmation_requires_clean_candidate_commit:${git.dirty.join(",")}`);
-    const manifest = await captureWorkspaceManifest(repository, workdir);
-    return {
-        repository,
-        workdir,
-        compiled,
-        manifest,
-        candidate: {
-            git_head: git.head,
-            git_tree: git.tree,
-            snapshot_sha256: manifest.snapshot_sha256,
-        },
-        candidate_dirty: git.dirty,
-        semantic_manifest: (await loadSemanticFactManifest(repository, compiled.task.source_paths)).manifest,
-    };
-}
-export async function readSubmittedExternalConfirmationRecord(recordPathInput) {
-    const file = path.resolve(recordPathInput);
-    const status = await lstat(file);
-    if (status.isSymbolicLink())
-        throw new Error(`external_confirmation_record_symlink_not_allowed:${file}`);
-    if (!status.isFile())
-        throw new Error(`external_confirmation_record_not_regular_file:${file}`);
-    if (typeof status.nlink === "number" && status.nlink > 1)
-        throw new Error(`external_confirmation_record_hardlink_not_allowed:${file}`);
-    if (status.size > MAX_SUBMITTED_RECORD_BYTES)
-        throw new Error(`external_confirmation_record_too_large:${status.size}`);
-    return parseExternalConfirmationRecord(JSON.parse(await readFile(file, "utf8")));
-}

package/dist/lib/long-task-external-confirmation-evaluation.d.ts

@@ -1,11 +0,0 @@
-import type { EffectiveExternalObligationV1 } from "./long-task-acceptance-reachability-types.js";
-import type { ExternalConfirmationV2 } from "./long-task-delivery-types.js";
-import type { ExternalAuthorityContextV1 } from "./long-task-external-confirmation-context.js";
-import type { ExternalConfirmationEvaluationV1, ExternalConfirmationRecord, ExternalConfirmationRecordV2 } from "./long-task-external-confirmation-types.js";
-export declare function evaluateExternalConfirmationRecord(context: ExternalAuthorityContextV1, confirmation: ExternalConfirmationV2, record: ExternalConfirmationRecord): Promise<ExternalConfirmationEvaluationV1>;
-export declare function externalConfirmationSubmissionEnvelopeIssues(context: ExternalAuthorityContextV1, confirmation: ExternalConfirmationV2, record: ExternalConfirmationRecordV2): Promise<string[]>;
-export declare function emptyExternalConfirmationEvaluation(context: ExternalAuthorityContextV1, confirmation: ExternalConfirmationV2, state: ExternalConfirmationEvaluationV1["state"], issues: string[]): Promise<ExternalConfirmationEvaluationV1>;
-export declare function partitionExternalConfirmationArtifactSnapshots(rows: EffectiveExternalObligationV1[], record: ExternalConfirmationRecordV2): {
-    blocking_or_shared: ExternalConfirmationRecordV2["artifact_snapshots"];
-    advisory_only: ExternalConfirmationRecordV2["artifact_snapshots"];
-};