project-tiny-context-harness 0.11.0 → 0.12.0

package/dist/lib/long-task-external-confirmation-identity.js

@@ -1,77 +0,0 @@
-import { matchesRepoPattern } from "./long-task-paths.js";
-import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
-export function deriveRelevantExternalInputIdentity(compiled, confirmationRef, manifest) {
-    const confirmation = requiredConfirmation(compiled, confirmationRef);
-    if (blockingExternalRows(compiled, confirmationRef).length)
-        return wholeCandidateIdentity(manifest);
-    const rows = allEffectiveExternalRows(compiled, confirmationRef);
-    const outcomeKeys = [...new Set(rows.map((row) => row.outcome_key))];
-    if (!rows.length || outcomeKeys.some((key) => key === null))
-        return wholeCandidateIdentity(manifest);
-    const outcomes = outcomeKeys.map((key) => compiled.outcomes.find((outcome) => outcome.key === key));
-    if (outcomes.some((outcome) => !outcome ||
-        !outcome.product.owner.path_globs.length ||
-        !outcome.technical.bindings.length ||
-        outcome.technical.bindings.some((binding) => !binding.carrier_paths.length)))
-        return wholeCandidateIdentity(manifest);
-    const patterns = [
-        ...new Set(outcomes.flatMap((outcome) => [
-            ...outcome.product.owner.path_globs,
-            ...outcome.technical.expected_change_paths,
-            ...outcome.technical.allowed_support_paths,
-            ...outcome.technical.bindings.flatMap((binding) => [
-                ...(binding.kind === "file" || binding.kind === "path_glob"
-                    ? [binding.target]
-                    : []),
-                ...binding.carrier_paths,
-            ]),
-        ])),
-    ].sort();
-    if (!patterns.length)
-        return wholeCandidateIdentity(manifest);
-    const files = manifest.files
-        .filter((file) => patterns.some((pattern) => matchesRepoPattern(file.path, pattern)))
-        .map((file) => ({
-        path: file.path,
-        mode: file.mode,
-        size: file.size,
-        sha256: file.sha256,
-    }))
-        .sort((left, right) => left.path.localeCompare(right.path));
-    const digest = sha256Hex(canonicalValueJson({ mode: "bounded_paths", patterns, files }));
-    return {
-        mode: "bounded_paths",
-        identity: `bounded:${digest}`,
-        paths: files.map((file) => file.path),
-    };
-}
-export function allEffectiveExternalRows(compiled, confirmationRef) {
-    return (compiled.acceptance_reachability.effective_external_routes ?? []).filter((row) => row.confirmation_ref === confirmationRef);
-}
-export function blockingExternalRows(compiled, confirmationRef) {
-    return allEffectiveExternalRows(compiled, confirmationRef).filter((row) => row.completion_role === "blocking");
-}
-export function advisoryExternalRows(compiled, confirmationRef) {
-    return allEffectiveExternalRows(compiled, confirmationRef).filter((row) => row.completion_role === "advisory");
-}
-export function requiredConfirmation(compiled, confirmationRef) {
-    const confirmation = compiled.global.acceptance.external_confirmations.find((candidate) => candidate.key === confirmationRef);
-    if (!confirmation)
-        throw new Error(`external_confirmation_unknown:${confirmationRef}`);
-    return confirmation;
-}
-export function sameSet(left, right) {
-    return (left.length === right.length &&
-        new Set(left).size === left.length &&
-        left.every((item) => right.includes(item)));
-}
-export function sameValue(left, right) {
-    return canonicalValueJson(left) === canonicalValueJson(right);
-}
-function wholeCandidateIdentity(manifest) {
-    return {
-        mode: "whole_candidate",
-        identity: `whole:${manifest.snapshot_sha256}`,
-        paths: manifest.files.map((file) => file.path).sort(),
-    };
-}

package/dist/lib/long-task-external-confirmation-plan.d.ts

@@ -1,25 +0,0 @@
-import type { CompiledDeliveryContractV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
-import { externalConfirmationRecordHash, externalConfirmationRecordV2Hash } from "./long-task-external-confirmation-shape.js";
-import type { ExternalConfirmationCandidateV1, ExternalConfirmationEvaluationV1, ExternalConfirmationPreparationV1 } from "./long-task-external-confirmation-types.js";
-import type { SemanticFactManifestV1 } from "./semantic-fact-types.js";
-export { deriveRelevantExternalInputIdentity } from "./long-task-external-confirmation-identity.js";
-export declare function prepareExternalConfirmations(workdirInput: string, confirmationRef?: string): Promise<ExternalConfirmationPreparationV1>;
-export declare function submitExternalConfirmation(input: {
-    workdir: string;
-    confirmation_ref: string;
-    record_path: string;
-}): Promise<ExternalConfirmationEvaluationV1>;
-export declare function externalConfirmationStatus(workdirInput: string): Promise<Record<string, unknown>>;
-export declare function revokeExternalConfirmation(input: {
-    workdir: string;
-    confirmation_ref: string;
-}): Promise<Record<string, unknown>>;
-export declare function rotateExternalConfirmation(input: {
-    workdir: string;
-    confirmation_ref: string;
-}): Promise<Record<string, unknown>>;
-export declare function evaluateExternalConfirmations(compiled: CompiledDeliveryContractV2, repository: string, workdir: string, manifest: WorkspaceManifestV2, candidate: ExternalConfirmationCandidateV1, semanticManifestInput?: SemanticFactManifestV1): Promise<ExternalConfirmationEvaluationV1[]>;
-export declare const externalConfirmationRecordIntegrity: {
-    hash_v1: typeof externalConfirmationRecordHash;
-    hash_v2: typeof externalConfirmationRecordV2Hash;
-};

package/dist/lib/long-task-external-confirmation-plan.js

@@ -1,148 +0,0 @@
-import { loadExternalAuthorityContext, readSubmittedExternalConfirmationRecord, } from "./long-task-external-confirmation-context.js";
-import { captureAndStoreExternalConfirmationArtifacts, MAX_TOTAL_EXTERNAL_CONFIRMATION_ARTIFACT_BYTES, } from "./long-task-external-confirmation-artifacts.js";
-import { rotateExternalConfirmationChallenge, } from "./long-task-external-confirmation-challenge.js";
-import { emptyExternalConfirmationEvaluation, evaluateExternalConfirmationRecord, externalConfirmationSubmissionEnvelopeIssues, partitionExternalConfirmationArtifactSnapshots, } from "./long-task-external-confirmation-evaluation.js";
-import { allEffectiveExternalRows, requiredConfirmation, } from "./long-task-external-confirmation-identity.js";
-import { externalFulfillableConfirmations, groupPreparationSessions, } from "./long-task-external-confirmation-preparation.js";
-import { externalConfirmationRecordHash, externalConfirmationRecordV2Hash, } from "./long-task-external-confirmation-shape.js";
-import { readStoredExternalConfirmationRecord, revokeStoredExternalConfirmationRecord, writeStoredExternalConfirmationRecord, } from "./long-task-external-confirmation-state.js";
-import { withActiveAuthorityLock } from "./long-task-state.js";
-import { repositoryRoot } from "./long-task-workspace.js";
-import { loadSemanticFactManifest } from "./semantic-fact-source-parser.js";
-export { deriveRelevantExternalInputIdentity } from "./long-task-external-confirmation-identity.js";
-export async function prepareExternalConfirmations(workdirInput, confirmationRef) {
-    const repository = await repositoryRoot(process.cwd());
-    return withActiveAuthorityLock(repository, "external_confirmation", async () => {
-        const context = await loadExternalAuthorityContext(workdirInput, true);
-        const confirmations = await externalFulfillableConfirmations(context, confirmationRef);
-        const sessions = groupPreparationSessions(confirmations, context.candidate);
-        return {
-            schema_version: "long-task-external-confirmation-preparation-v2",
-            acceptance_effect: "none",
-            notice: "Preparation output does not establish acceptance.",
-            task_id: context.compiled.task.id,
-            compiled_identity: context.compiled.compiled_identity,
-            authority_revision: context.compiled.authority_revision,
-            candidate: context.candidate,
-            actor_identity_boundary: "detached_ed25519_required_for_blocking_fulfillment",
-            confirmations,
-            sessions,
-            generated_at: new Date().toISOString(),
-        };
-    });
-}
-export async function submitExternalConfirmation(input) {
-    const repository = await repositoryRoot(process.cwd());
-    return withActiveAuthorityLock(repository, "external_confirmation", async () => {
-        const context = await loadExternalAuthorityContext(input.workdir, true);
-        const confirmation = requiredConfirmation(context.compiled, input.confirmation_ref);
-        const record = await readSubmittedExternalConfirmationRecord(input.record_path);
-        if (record.confirmation_ref !== input.confirmation_ref)
-            throw new Error(`external_confirmation_submit_ref_mismatch:${input.confirmation_ref}:${record.confirmation_ref}`);
-        if (record.schema_version !== "long-task-external-confirmation-record-v2")
-            throw new Error("external_confirmation_submit_rejected:legacy_unattested");
-        const envelopeIssues = await externalConfirmationSubmissionEnvelopeIssues(context, confirmation, record);
-        if (envelopeIssues.length)
-            throw new Error(`external_confirmation_submit_rejected:${envelopeIssues.join(",")}`);
-        const rows = allEffectiveExternalRows(context.compiled, confirmation.key);
-        const artifactPartitions = partitionExternalConfirmationArtifactSnapshots(rows, record);
-        await captureAndStoreExternalConfirmationArtifacts(context.repository, context.workdir, artifactPartitions.blocking_or_shared);
-        const blockingArtifactBytes = Object.values(artifactPartitions.blocking_or_shared).reduce((total, snapshot) => total + snapshot.size_bytes, 0);
-        if (Object.keys(artifactPartitions.advisory_only).length)
-            await captureAndStoreExternalConfirmationArtifacts(context.repository, context.workdir, artifactPartitions.advisory_only, {
-                max_total_bytes: Math.max(0, MAX_TOTAL_EXTERNAL_CONFIRMATION_ARTIFACT_BYTES -
-                    blockingArtifactBytes),
-            }).catch(() => {
-                // The role-scoped evaluation below records an absent or invalid
-                // advisory partition without contaminating a fulfilled blocking row.
-            });
-        const evaluation = await evaluateExternalConfirmationRecord(context, confirmation, record);
-        if (evaluation.state === "invalid" ||
-            evaluation.state === "stale" ||
-            evaluation.state === "legacy_unattested")
-            throw new Error(`external_confirmation_submit_rejected:${evaluation.state}:${evaluation.issues.join(",")}`);
-        await writeStoredExternalConfirmationRecord(context.repository, context.workdir, record);
-        return evaluation;
-    });
-}
-export async function externalConfirmationStatus(workdirInput) {
-    const context = await loadExternalAuthorityContext(workdirInput, false);
-    return {
-        schema_version: "long-task-external-confirmation-status-v2",
-        task_id: context.compiled.task.id,
-        compiled_identity: context.compiled.compiled_identity,
-        authority_revision: context.compiled.authority_revision,
-        candidate: context.candidate,
-        candidate_clean: context.candidate_dirty.length === 0,
-        candidate_dirty: context.candidate_dirty,
-        actor_identity_boundary: "detached_ed25519_required_for_blocking_fulfillment",
-        confirmations: await evaluateExternalConfirmations(context.compiled, context.repository, context.workdir, context.manifest, context.candidate, context.semantic_manifest),
-    };
-}
-export async function revokeExternalConfirmation(input) {
-    const repository = await repositoryRoot(process.cwd());
-    return withActiveAuthorityLock(repository, "external_confirmation", async () => {
-        const context = await loadExternalAuthorityContext(input.workdir, false);
-        requiredConfirmation(context.compiled, input.confirmation_ref);
-        const challenge = await rotateExternalConfirmationChallenge(context, input.confirmation_ref);
-        const revoked = await revokeStoredExternalConfirmationRecord(context.repository, context.workdir, input.confirmation_ref);
-        return {
-            schema_version: "long-task-external-confirmation-revoke-v2",
-            confirmation_ref: input.confirmation_ref,
-            status: revoked ? "revoked" : "not_present",
-            challenge_rotated: true,
-            challenge: challenge.challenge,
-        };
-    });
-}
-export async function rotateExternalConfirmation(input) {
-    const repository = await repositoryRoot(process.cwd());
-    return withActiveAuthorityLock(repository, "external_confirmation", async () => {
-        const context = await loadExternalAuthorityContext(input.workdir, false);
-        requiredConfirmation(context.compiled, input.confirmation_ref);
-        const challenge = await rotateExternalConfirmationChallenge(context, input.confirmation_ref);
-        return {
-            schema_version: "long-task-external-confirmation-rotate-v1",
-            confirmation_ref: input.confirmation_ref,
-            challenge: challenge.challenge,
-            rotated_at: challenge.rotated_at,
-        };
-    });
-}
-export async function evaluateExternalConfirmations(compiled, repository, workdir, manifest, candidate, semanticManifestInput) {
-    const semanticManifest = semanticManifestInput ??
-        (await loadSemanticFactManifest(repository, compiled.task.source_paths))
-            .manifest;
-    const context = {
-        repository,
-        workdir,
-        compiled,
-        manifest,
-        candidate,
-        candidate_dirty: [],
-        semantic_manifest: semanticManifest,
-    };
-    const results = [];
-    for (const confirmation of [
-        ...compiled.global.acceptance.external_confirmations,
-    ].sort((left, right) => left.key.localeCompare(right.key))) {
-        const stored = await readStoredExternalConfirmationRecord(repository, workdir, confirmation.key);
-        if (stored.error) {
-            results.push(await emptyExternalConfirmationEvaluation(context, confirmation, "invalid", [`record_invalid:${stored.error}`]));
-            continue;
-        }
-        if (!stored.record) {
-            const exactRows = allEffectiveExternalRows(compiled, confirmation.key);
-            results.push(exactRows.length || !confirmation.blocks_target
-                ? await emptyExternalConfirmationEvaluation(context, confirmation, "pending", [])
-                : await emptyExternalConfirmationEvaluation(context, confirmation, "invalid", ["blocking_confirmation_has_no_exact_obligations"]));
-            continue;
-        }
-        results.push(await evaluateExternalConfirmationRecord(context, confirmation, stored.record));
-    }
-    return results;
-}
-export const externalConfirmationRecordIntegrity = {
-    hash_v1: externalConfirmationRecordHash,
-    hash_v2: externalConfirmationRecordV2Hash,
-};

package/dist/lib/long-task-external-confirmation-preparation.d.ts

@@ -1,4 +0,0 @@
-import type { ExternalAuthorityContextV1 } from "./long-task-external-confirmation-context.js";
-import type { ExternalConfirmationCandidateV1, ExternalConfirmationPreparationConfirmationV1, ExternalConfirmationPreparationSessionV1 } from "./long-task-external-confirmation-types.js";
-export declare function externalFulfillableConfirmations(context: ExternalAuthorityContextV1, confirmationRef?: string): Promise<ExternalConfirmationPreparationConfirmationV1[]>;
-export declare function groupPreparationSessions(confirmations: ExternalConfirmationPreparationConfirmationV1[], candidate: ExternalConfirmationCandidateV1): ExternalConfirmationPreparationSessionV1[];

package/dist/lib/long-task-external-confirmation-preparation.js

@@ -1,100 +0,0 @@
-import { compiledExternalConfirmationIdentityAssurance, externalConfirmationActor, } from "./long-task-external-confirmation-attestation.js";
-import { readOrCreateExternalConfirmationChallenge } from "./long-task-external-confirmation-challenge.js";
-import { expectedForExternalObligation } from "./long-task-external-confirmation-expected.js";
-import { allEffectiveExternalRows, deriveRelevantExternalInputIdentity, requiredConfirmation, } from "./long-task-external-confirmation-identity.js";
-import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
-export async function externalFulfillableConfirmations(context, confirmationRef) {
-    if (confirmationRef)
-        requiredConfirmation(context.compiled, confirmationRef);
-    const declarations = context.compiled.global.acceptance.external_confirmations.filter((confirmation) => (!confirmationRef || confirmation.key === confirmationRef) &&
-        allEffectiveExternalRows(context.compiled, confirmation.key).length > 0);
-    const selected = (await Promise.all(declarations.map((confirmation) => prepareConfirmation(context, confirmation)))).sort((left, right) => left.confirmation_ref.localeCompare(right.confirmation_ref));
-    if (confirmationRef && !selected.length)
-        throw new Error(`external_confirmation_not_fulfillable:${confirmationRef}`);
-    return selected;
-}
-export function groupPreparationSessions(confirmations, candidate) {
-    const groups = new Map();
-    for (const confirmation of confirmations) {
-        const rows = groups.get(confirmation.session_group) ?? [];
-        rows.push(confirmation);
-        groups.set(confirmation.session_group, rows);
-    }
-    return [...groups.entries()]
-        .map(([sessionGroup, rows]) => {
-        const first = rows[0];
-        return {
-            session_group: sessionGroup,
-            suggested_session_id: `external-${sessionGroup.slice(0, 16)}-${candidate.snapshot_sha256.slice(0, 12)}`,
-            actor: first.actor,
-            identity_assurance: first.identity_assurance,
-            target_ref: first.target_ref,
-            environment_identity: first.environment_identity,
-            scenario: first.scenario,
-            evidence_requirements: first.evidence_requirements,
-            confirmation_refs: rows.map((row) => row.confirmation_ref).sort(),
-            obligations: rows
-                .flatMap((row) => row.obligations)
-                .sort((left, right) => left.obligation_ref.localeCompare(right.obligation_ref)),
-        };
-    })
-        .sort((left, right) => left.session_group.localeCompare(right.session_group));
-}
-async function prepareConfirmation(context, confirmation) {
-    if (!confirmation.actor ||
-        !confirmation.target_ref ||
-        !confirmation.environment_identity ||
-        !confirmation.scenario ||
-        !confirmation.evidence_requirements?.length ||
-        !confirmation.obligations?.length)
-        throw new Error(`external_confirmation_declaration_incomplete:${confirmation.key}`);
-    const actor = externalConfirmationActor(confirmation);
-    const identityAssurance = compiledExternalConfirmationIdentityAssurance(context.compiled, confirmation.key);
-    if (!actor || !identityAssurance || identityAssurance.scheme !== "ed25519")
-        throw new Error(`external_confirmation_authenticated_actor_required:${confirmation.key}`);
-    const challenge = await readOrCreateExternalConfirmationChallenge(context, confirmation.key);
-    const relevant = deriveRelevantExternalInputIdentity(context.compiled, confirmation.key, context.manifest);
-    const obligations = allEffectiveExternalRows(context.compiled, confirmation.key)
-        .map((row) => prepareObligation(context, confirmation, row))
-        .sort((left, right) => left.obligation_ref.localeCompare(right.obligation_ref));
-    const groups = [...new Set(obligations.map((row) => row.session_group))];
-    if (groups.length !== 1 || !groups[0])
-        throw new Error(`external_confirmation_session_group_invalid:${confirmation.key}`);
-    const prepared = {
-        confirmation_ref: confirmation.key,
-        description: confirmation.description,
-        owner: confirmation.owner,
-        actor,
-        identity_assurance: identityAssurance,
-        target_ref: confirmation.target_ref,
-        environment_identity: confirmation.environment_identity,
-        scenario: confirmation.scenario,
-        evidence_requirements: confirmation.evidence_requirements,
-        session_group: groups[0],
-        relevant_input_identity: relevant.identity,
-        relevant_input_mode: relevant.mode,
-        relevant_input_paths: relevant.paths,
-        challenge: challenge.challenge,
-        obligations,
-    };
-    return {
-        ...prepared,
-        signable_canonical_digest: sha256Hex(canonicalValueJson({
-            schema_version: "long-task-external-confirmation-signing-context-v2",
-            compiled_identity: context.compiled.compiled_identity,
-            authority_revision: context.compiled.authority_revision,
-            candidate: context.candidate,
-            ...prepared,
-        })),
-    };
-}
-function prepareObligation(context, confirmation, row) {
-    const declaration = confirmation.obligations.find((obligation) => obligation.key === row.obligation_ref);
-    if (!declaration)
-        throw new Error(`external_confirmation_obligation_declaration_missing:${confirmation.key}:${row.obligation_ref}`);
-    return {
-        ...row,
-        result_kind: declaration.result_kind,
-        expected: expectedForExternalObligation(context.compiled, context.semantic_manifest, row, declaration.expected_authority_ref),
-    };
-}

package/dist/lib/long-task-external-confirmation-shape.d.ts

@@ -1,8 +0,0 @@
-import type { ExternalConfirmationRecord, ExternalConfirmationRecordV1, ExternalConfirmationRecordV2 } from "./long-task-external-confirmation-types.js";
-export declare function parseExternalConfirmationRecord(value: unknown): ExternalConfirmationRecord;
-export declare function parseExternalConfirmationRecordV1(value: unknown): ExternalConfirmationRecordV1;
-export declare function parseExternalConfirmationRecordV2(value: unknown): ExternalConfirmationRecordV2;
-export declare function externalConfirmationRecordHash(record: Omit<ExternalConfirmationRecordV1, "record_sha256"> | ExternalConfirmationRecordV1): string;
-export declare function signExternalConfirmationRecordV1(unsigned: Omit<ExternalConfirmationRecordV1, "record_sha256">): ExternalConfirmationRecordV1;
-export declare function externalConfirmationRecordV2Hash(record: Omit<ExternalConfirmationRecordV2, "record_sha256"> | ExternalConfirmationRecordV2): string;
-export declare function externalConfirmationV2SignablePayload(record: ExternalConfirmationRecordV2): string;