project-tiny-context-harness 0.11.0 → 0.12.0

package/dist/lib/long-task-json-pointer-observation.js

@@ -1,184 +0,0 @@
-import path from "node:path";
-import { canonicalValueJson, parseStrictYaml, sha256Hex, } from "./strict-codec.js";
-export const JSON_POINTER_EXACT_CAPABILITY = "json-pointer-exact-v1";
-export const JSON_POINTER_EXACT_ORACLE_IDENTITY = "ty-context-json-pointer-exact";
-export const JSON_POINTER_EXACT_ORACLE_VERSION = "1.0.0";
-export const JSON_POINTER_EXACT_METHODS = Object.freeze([
-    "exact_value",
-    "content",
-    "component_state",
-]);
-export const JSON_POINTER_EXACT_LIMITS = Object.freeze({
-    max_file_bytes: 1_048_576,
-    max_depth: 64,
-    max_pointer_bytes: 4_096,
-    max_pointer_segments: 128,
-    max_canonical_value_bytes: 262_144,
-    max_artifacts_per_check: 256,
-    max_total_artifact_bytes: 16_777_216,
-});
-export const JSON_POINTER_EXACT_SPEC_SHA256 = sha256Hex(canonicalValueJson({
-    capability: JSON_POINTER_EXACT_CAPABILITY,
-    oracle_identity: JSON_POINTER_EXACT_ORACLE_IDENTITY,
-    oracle_version: JSON_POINTER_EXACT_ORACLE_VERSION,
-    media_type: "application/json",
-    encoding: "utf-8",
-    locator: "rfc6901-json-pointer",
-    canonicalization: "canonical-json-v1",
-    methods: JSON_POINTER_EXACT_METHODS,
-    comparator: "exact_value",
-    mode: "exact",
-    sensitivity: "plain",
-    limits: JSON_POINTER_EXACT_LIMITS,
-}));
-export function createJsonPointerExactBudget() {
-    return { seen_artifact_paths: new Set(), total_artifact_bytes: 0 };
-}
-export function isJsonPointerExactOracle(oracle) {
-    return (oracle.trust === "named_external_tcb" &&
-        oracle.identity === JSON_POINTER_EXACT_ORACLE_IDENTITY &&
-        oracle.version === JSON_POINTER_EXACT_ORACLE_VERSION &&
-        oracle.sha256 === null);
-}
-export function extractJsonPointerExactObservationFromBytes(input) {
-    const artifactPath = normalizeObservationArtifactPath(input.artifact_path);
-    if (input.sensitivity !== "plain")
-        throw invalidObservation("observation_protected_requires_frozen_adapter");
-    if (input.bytes.byteLength > JSON_POINTER_EXACT_LIMITS.max_file_bytes)
-        throw invalidObservation("observation_artifact_size_limit");
-    accountForArtifact(input.budget, artifactPath, input.bytes.byteLength);
-    const locator = validateJsonPointerExactLocator(input.locator);
-    const parsed = parseJsonWithoutDuplicateKeys(decodeUtf8Json(input.bytes));
-    assertJsonTree(parsed, 0);
-    const canonical = canonicalValueJson(resolveJsonPointer(parsed, locator.value));
-    const canonicalBytes = Buffer.byteLength(canonical, "utf8");
-    if (canonicalBytes > JSON_POINTER_EXACT_LIMITS.max_canonical_value_bytes)
-        throw invalidObservation("observation_canonical_value_size_limit");
-    return {
-        capability: JSON_POINTER_EXACT_CAPABILITY,
-        artifact_path: artifactPath,
-        artifact_sha256: sha256Hex(input.bytes),
-        locator,
-        value_sha256: sha256Hex(canonical),
-        canonical_value_bytes: canonicalBytes,
-        sensitivity: "plain",
-    };
-}
-export function validateJsonPointerExactLocator(locator) {
-    if (locator.kind !== "json_pointer" ||
-        typeof locator.value !== "string" ||
-        locator.value.startsWith("#") ||
-        (locator.value !== "" && !locator.value.startsWith("/")) ||
-        Buffer.byteLength(locator.value, "utf8") >
-            JSON_POINTER_EXACT_LIMITS.max_pointer_bytes)
-        throw invalidObservation("observation_locator_not_admitted");
-    const encoded = locator.value === "" ? [] : locator.value.slice(1).split("/");
-    if (encoded.length > JSON_POINTER_EXACT_LIMITS.max_pointer_segments)
-        throw invalidObservation("observation_locator_segment_limit");
-    for (const token of encoded)
-        if (/~(?:[^01]|$)/u.test(token))
-            throw invalidObservation("observation_locator_not_admitted");
-    return { kind: "json_pointer", value: locator.value };
-}
-export function normalizeObservationArtifactPath(value) {
-    if (!value ||
-        value.includes("\\") ||
-        value.includes("\0") ||
-        path.posix.isAbsolute(value) ||
-        /^[a-z]:/iu.test(value))
-        throw invalidObservation("observation_artifact_path_escape");
-    const segments = value.split("/");
-    if (segments.some((segment) => !segment || segment === "." || segment === ".."))
-        throw invalidObservation("observation_artifact_path_escape");
-    return segments.join("/");
-}
-export function invalidObservation(code) {
-    return new Error(code);
-}
-export function observationErrorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-export function resolveJsonPointer(root, pointer) {
-    let current = root;
-    if (pointer === "")
-        return current;
-    for (const encoded of pointer.slice(1).split("/")) {
-        const token = encoded.replace(/~1/gu, "/").replace(/~0/gu, "~");
-        if (Array.isArray(current)) {
-            if (!/^(?:0|[1-9]\d*)$/u.test(token))
-                throw invalidObservation("observation_locator_array_index_invalid");
-            const index = Number(token);
-            if (!Number.isSafeInteger(index) || index >= current.length)
-                throw invalidObservation("observation_locator_not_found");
-            current = current[index];
-            continue;
-        }
-        if (!current ||
-            typeof current !== "object" ||
-            !Object.hasOwn(current, token))
-            throw invalidObservation("observation_locator_not_found");
-        current = current[token];
-    }
-    return current;
-}
-export function parseJsonWithoutDuplicateKeys(content) {
-    let parsed;
-    try {
-        parsed = JSON.parse(content);
-    }
-    catch {
-        throw invalidObservation("observation_json_invalid");
-    }
-    try {
-        const strict = parseStrictYaml(content);
-        if (canonicalValueJson(strict) !== canonicalValueJson(parsed))
-            throw invalidObservation("observation_json_canonicalization_mismatch");
-    }
-    catch (error) {
-        if (observationErrorMessage(error).includes("unique"))
-            throw invalidObservation("observation_json_duplicate_key");
-        if (observationErrorMessage(error).startsWith("observation_"))
-            throw error;
-        throw invalidObservation("observation_json_invalid");
-    }
-    return parsed;
-}
-export function decodeUtf8Json(bytes) {
-    if (bytes.byteLength >= 3 &&
-        bytes[0] === 0xef &&
-        bytes[1] === 0xbb &&
-        bytes[2] === 0xbf)
-        throw invalidObservation("observation_json_utf8_invalid");
-    try {
-        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-    }
-    catch {
-        throw invalidObservation("observation_json_utf8_invalid");
-    }
-}
-export function assertJsonTree(value, depth) {
-    if (depth > JSON_POINTER_EXACT_LIMITS.max_depth)
-        throw invalidObservation("observation_json_depth_limit");
-    if (typeof value === "number" && !Number.isFinite(value))
-        throw invalidObservation("observation_json_number_invalid");
-    if (Array.isArray(value)) {
-        for (const entry of value)
-            assertJsonTree(entry, depth + 1);
-        return;
-    }
-    if (value && typeof value === "object")
-        for (const entry of Object.values(value))
-            assertJsonTree(entry, depth + 1);
-}
-function accountForArtifact(budget, artifactPath, bytes) {
-    if (!budget || budget.seen_artifact_paths.has(artifactPath))
-        return;
-    if (budget.seen_artifact_paths.size >=
-        JSON_POINTER_EXACT_LIMITS.max_artifacts_per_check)
-        throw invalidObservation("observation_artifact_count_limit");
-    if (budget.total_artifact_bytes + bytes >
-        JSON_POINTER_EXACT_LIMITS.max_total_artifact_bytes)
-        throw invalidObservation("observation_artifact_total_size_limit");
-    budget.seen_artifact_paths.add(artifactPath);
-    budget.total_artifact_bytes += bytes;
-}

package/dist/lib/long-task-material-input-closure.d.ts

@@ -1,3 +0,0 @@
-import type { CompiledSourceItemV2, MaterialTextInputV2 } from "./long-task-source-authority-types.js";
-import type { SemanticFactManifestV1 } from "./semantic-fact-types.js";
-export declare function deriveMaterialTextInputs(repository: string, sourceItems: CompiledSourceItemV2[], manifest: SemanticFactManifestV1, designOwnedSourceItems: ReadonlySet<string>): Promise<MaterialTextInputV2[]>;

package/dist/lib/long-task-material-input-closure.js

@@ -1,92 +0,0 @@
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { TextDecoder } from "node:util";
-import { assertProtectedRepositoryFile } from "./long-task-protected-files.js";
-import { semanticFactClosureInvalid } from "./long-task-semantic-fact-closure-primitives.js";
-import { sourceAuthorityDomain } from "./long-task-source-fragments.js";
-import { sha256Hex } from "./strict-codec.js";
-const MATERIAL_RESOURCE_KINDS = new Set([
-    "attachment",
-    "canonical_spec",
-    "repository_preservation",
-    "external_constraint",
-    "delegated_instruction",
-    "design_resource",
-]);
-export async function deriveMaterialTextInputs(repository, sourceItems, manifest, designOwnedSourceItems) {
-    const sourceByKey = new Map(sourceItems.map((item) => [item.key, item]));
-    const result = sourceItems.map((item) => ({
-        input_key: item.key,
-        input_kind: "source_item",
-        source_ref: item.source_path,
-        sha256: item.text_sha256,
-        authority_source_item_refs: [item.key],
-        authority_domain: sourceAuthorityDomain(item, designOwnedSourceItems.has(item.key)),
-        normalized_text: normalizeText(item.normalized_text),
-    }));
-    for (const input of manifest.inputs) {
-        if (!MATERIAL_RESOURCE_KINDS.has(input.kind))
-            continue;
-        const file = await assertProtectedRepositoryFile(repository, path.resolve(repository, ...input.source_ref.split("/")), `material_text_input:${input.key}`);
-        const bytes = await readFile(file);
-        if (sha256Hex(bytes) !== input.sha256)
-            semanticFactClosureInvalid("material_text_input_digest_mismatch", `${input.key}:${input.source_ref}`);
-        const decoded = decodeStrictUtf8(bytes);
-        if (decoded === null) {
-            if (input.kind === "design_resource" && input.disposition === "ui_design")
-                continue;
-            semanticFactClosureInvalid("material_text_input_invalid_utf8", `${input.key}:${input.source_ref}`);
-        }
-        if (!decoded.trim())
-            semanticFactClosureInvalid("material_text_input_empty_or_ambiguous", `${input.key}:${input.source_ref}`);
-        const authoritySourceItemRefs = authoritySources(input, manifest, sourceByKey);
-        const authorityDomain = input.kind === "design_resource"
-            ? "design"
-            : oneAuthorityDomain(input.key, authoritySourceItemRefs.map((ref) => sourceAuthorityDomain(sourceByKey.get(ref), designOwnedSourceItems.has(ref))));
-        result.push({
-            input_key: input.key,
-            input_kind: input.kind,
-            source_ref: input.source_ref,
-            sha256: input.sha256,
-            authority_source_item_refs: authoritySourceItemRefs,
-            authority_domain: authorityDomain,
-            normalized_text: normalizeText(decoded),
-        });
-    }
-    return result.sort((left, right) => left.input_key.localeCompare(right.input_key));
-}
-function authoritySources(input, manifest, sourceByKey) {
-    const facts = new Map(manifest.facts.map((fact) => [fact.key, fact]));
-    const directRefs = new Set();
-    for (const basisRef of input.basis_refs)
-        if (sourceByKey.has(basisRef))
-            directRefs.add(basisRef);
-    if (directRefs.size)
-        return [...directRefs].sort();
-    const refs = new Set();
-    for (const factRef of input.fact_refs)
-        for (const sourceRef of facts.get(factRef)?.source_item_refs ?? [])
-            if (sourceByKey.has(sourceRef))
-                refs.add(sourceRef);
-    if (!refs.size)
-        semanticFactClosureInvalid("material_text_input_authority_source_required", input.key);
-    return [...refs].sort();
-}
-function oneAuthorityDomain(inputKey, domains) {
-    const unique = [...new Set(domains)];
-    if (unique.length !== 1)
-        semanticFactClosureInvalid("material_text_input_authority_domain_ambiguous", `${inputKey}:${unique.sort().join(",")}`);
-    return unique[0];
-}
-function decodeStrictUtf8(bytes) {
-    try {
-        const decoded = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-        return decoded.includes("\0") ? null : decoded;
-    }
-    catch {
-        return null;
-    }
-}
-function normalizeText(value) {
-    return value.replace(/\r\n?/gu, "\n");
-}

package/dist/lib/long-task-obligation-authority-resolution.d.ts

@@ -1,12 +0,0 @@
-import type { ExternalAuthorityRouteV1, MachineAuthorityRouteV1, ObligationAuthorityCandidatesV1 } from "./long-task-acceptance-reachability-types.js";
-export type ObligationAuthorityResolutionV1 = {
-    status: "machine_admitted";
-    machine: MachineAuthorityRouteV1;
-} | {
-    status: "external_candidate";
-    external: ExternalAuthorityRouteV1;
-} | {
-    status: "unreachable";
-    reason: "machine_external_authority_conflict" | "authority_route_ambiguous" | "proof_surface_authority_ambiguous" | "no_admitted_proof_route";
-};
-export declare function resolveObligationAuthority(candidates: ObligationAuthorityCandidatesV1): ObligationAuthorityResolutionV1;

package/dist/lib/long-task-obligation-authority-resolution.js

@@ -1,57 +0,0 @@
-export function resolveObligationAuthority(candidates) {
-    const machine = candidates.machine_candidates;
-    const external = candidates.external_candidates;
-    if (external.some((route) => route.authority_ambiguous))
-        return { status: "unreachable", reason: "authority_route_ambiguous" };
-    if (external.some((route) => route.authority_unresolved))
-        return {
-            status: "unreachable",
-            reason: "proof_surface_authority_ambiguous",
-        };
-    if (candidates.proof_surface_selection === "optional") {
-        if (machine.length > 1 ||
-            new Set(external.map((route) => route.proof_surface)).size !==
-                external.length)
-            return { status: "unreachable", reason: "authority_route_ambiguous" };
-        if (machine.length === 1 && external.length > 0) {
-            if (external.some((route) => route.proof_surface === machine[0].proof_surface))
-                return {
-                    status: "unreachable",
-                    reason: "machine_external_authority_conflict",
-                };
-            if (external.some((route) => route.advisory_to_machine !== true &&
-                route.semantic_identity !== null &&
-                route.semantic_identity !== undefined))
-                return {
-                    status: "unreachable",
-                    reason: "machine_external_authority_conflict",
-                };
-            if (external.some((route) => route.advisory_to_machine !== true))
-                return {
-                    status: "unreachable",
-                    reason: "proof_surface_authority_ambiguous",
-                };
-            const routes = [machine[0], ...external];
-            const semanticProfiles = new Set(routes.flatMap((route) => route.semantic_identity ? [route.semantic_identity] : []));
-            if (routes.some((route) => !route.semantic_identity) ||
-                semanticProfiles.size > 1)
-                return {
-                    status: "unreachable",
-                    reason: "proof_surface_authority_ambiguous",
-                };
-            return { status: "machine_admitted", machine: machine[0] };
-        }
-    }
-    if (machine.length && external.length)
-        return {
-            status: "unreachable",
-            reason: "machine_external_authority_conflict",
-        };
-    if (machine.length > 1 || external.length > 1)
-        return { status: "unreachable", reason: "authority_route_ambiguous" };
-    if (machine.length === 1)
-        return { status: "machine_admitted", machine: machine[0] };
-    if (external.length === 1)
-        return { status: "external_candidate", external: external[0] };
-    return { status: "unreachable", reason: "no_admitted_proof_route" };
-}

package/dist/lib/long-task-obligation-semantic-identity.d.ts

@@ -1,16 +0,0 @@
-import type { CompiledObservationAuthorityV2, DeliveryContractV2, EvidenceCapabilityV2 } from "./long-task-delivery-types.js";
-import type { AcceptanceReachabilityInputV1, ExpectedExternalObligation } from "./long-task-acceptance-reachability-types.js";
-export interface ObjectiveClaimSemanticIdentityInputV1 {
-    contract: Pick<DeliveryContractV2, "global" | "outcomes">;
-    outcome_key: string | null;
-    claim_ref: string;
-    local_claim_ref: string;
-    applicability_ref: string;
-    required_polarity: "positive" | "negative";
-    expected_authority_ref: string;
-    method: string;
-    required_evidence_capabilities: readonly EvidenceCapabilityV2[];
-    observation_authority: CompiledObservationAuthorityV2;
-}
-export declare function objectiveClaimSemanticIdentity(input: ObjectiveClaimSemanticIdentityInputV1): string | null;
-export declare function effectiveExternalObligationSemanticIdentity(input: AcceptanceReachabilityInputV1, expected: ExpectedExternalObligation): string | null;

package/dist/lib/long-task-obligation-semantic-identity.js

@@ -1,116 +0,0 @@
-import { findDesignFactObligation } from "./long-task-design-obligation.js";
-import { canonicalApplicabilityIdentity, claimApplicabilityProfile, } from "./long-task-applicability-identity.js";
-import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
-export function objectiveClaimSemanticIdentity(input) {
-    const authority = input.observation_authority;
-    const applicability = claimApplicabilityProfile(input.contract, input.outcome_key, input.applicability_ref);
-    const requiredCapabilities = [
-        ...new Set(input.required_evidence_capabilities),
-    ].sort();
-    if (!applicability ||
-        authority.fact_ref !== null ||
-        authority.claim_refs.length !== 1 ||
-        authority.claim_refs[0] !== input.local_claim_ref ||
-        authority.target_ref !== applicability.target_ref ||
-        authority.method !== input.method ||
-        !requiredCapabilities.every((capability) => authority.evidence_capabilities.includes(capability)) ||
-        !exactObservationAuthorityShape(authority))
-        return null;
-    return sha256Hex(canonicalValueJson({
-        claim_ref: input.claim_ref,
-        local_claim_ref: input.local_claim_ref,
-        applicability_identity: canonicalApplicabilityIdentity(applicability),
-        target_ref: applicability.target_ref,
-        required_polarity: input.required_polarity,
-        expected_authority_ref: input.expected_authority_ref,
-        expected_value_sha256: authority.expected_value_sha256,
-        actual_projection: authority.actual_projection,
-        method: input.method,
-        required_evidence_capabilities: requiredCapabilities,
-        comparison: authority.comparison,
-    }));
-}
-export function effectiveExternalObligationSemanticIdentity(input, expected) {
-    if (expected.semantic_identity)
-        return expected.semantic_identity;
-    const applicability = claimApplicabilityProfile(input.contract, expected.outcome_key, expected.applicability_ref);
-    if (!applicability)
-        return null;
-    const common = {
-        source_obligation_ref: expected.source_obligation_ref,
-        claim_ref: expected.claim_ref,
-        local_claim_ref: expected.local_claim_ref,
-        applicability_identity: canonicalApplicabilityIdentity(applicability),
-        target_ref: applicability.target_ref,
-        required_polarity: expected.required_polarity,
-        expected_authority_ref: expected.expected_authority_ref,
-        method: expected.method,
-        required_evidence_capabilities: [
-            ...new Set(expected.evidence_capabilities),
-        ].sort(),
-    };
-    if (expected.fact_ref && expected.proof_ref) {
-        const design = findDesignFactObligation(input.contract, expected);
-        if (design)
-            return sha256Hex(canonicalValueJson({
-                kind: "design_fact",
-                ...common,
-                design_obligation_ref: design.source_obligation_ref,
-                design_target_ref: design.target_key,
-                fact_ref: design.fact_ref,
-                proof_ref: design.source_obligation_ref,
-                expected_design_sha256: design.expected.sha256,
-                actual_projection: "raw_exact",
-                comparison: {
-                    comparator: design.comparison.comparator,
-                    mode: design.comparison.mode,
-                    parameters_sha256: design.comparison.parameters.sha256,
-                    tolerance_sha256: design.comparison.tolerance?.sha256 ?? null,
-                    mask_sha256: design.comparison.mask?.sha256 ?? null,
-                },
-            }));
-        const fact = input.manifest.facts.find((candidate) => candidate.key === expected.fact_ref);
-        const proof = input.manifest.proof_obligations.find((candidate) => candidate.key === expected.proof_ref &&
-            candidate.fact_ref === expected.fact_ref);
-        if (fact && proof)
-            return sha256Hex(canonicalValueJson({
-                kind: "semantic_fact",
-                ...common,
-                fact_ref: fact.key,
-                proof_ref: proof.key,
-                expected_value_sha256: fact.expected.sha256,
-                actual_projection: "raw_exact",
-                comparison: {
-                    comparator: proof.comparison.comparator,
-                    mode: proof.comparison.mode,
-                    parameters_sha256: proof.comparison.parameters.sha256,
-                    tolerance_sha256: proof.comparison.tolerance?.sha256 ?? null,
-                    mask_sha256: proof.comparison.mask?.sha256 ?? null,
-                },
-            }));
-        return null;
-    }
-    if (expected.fact_ref || expected.proof_ref)
-        return null;
-    return sha256Hex(canonicalValueJson({
-        kind: "source_delegated_judgment",
-        ...common,
-        expected_value_sha256: null,
-        actual_projection: null,
-        comparison: null,
-    }));
-}
-function exactObservationAuthorityShape(authority) {
-    return Boolean(typeof authority.expected_value_sha256 === "string" &&
-        /^[a-f0-9]{64}$/u.test(authority.expected_value_sha256) &&
-        typeof authority.actual_projection === "string" &&
-        authority.comparison &&
-        typeof authority.comparison.comparator === "string" &&
-        typeof authority.comparison.mode === "string" &&
-        sha256OrNull(authority.comparison.parameters_sha256) &&
-        sha256OrNull(authority.comparison.tolerance_sha256) &&
-        sha256OrNull(authority.comparison.mask_sha256));
-}
-function sha256OrNull(value) {
-    return value === null || /^[a-f0-9]{64}$/u.test(value);
-}

package/dist/lib/long-task-observation-artifact.d.ts

@@ -1,8 +0,0 @@
-import { type JsonPointerExactBudget, type JsonPointerExactLocator, type JsonPointerExactObservation } from "./long-task-json-pointer-observation.js";
-export declare function extractJsonPointerExactObservation(input: {
-    root: string;
-    artifact_path: string;
-    locator: JsonPointerExactLocator;
-    sensitivity: string;
-    budget?: JsonPointerExactBudget;
-}): Promise<JsonPointerExactObservation>;

package/dist/lib/long-task-observation-artifact.js

@@ -1,58 +0,0 @@
-import { lstat, open, realpath } from "node:fs/promises";
-import path from "node:path";
-import { JSON_POINTER_EXACT_LIMITS, extractJsonPointerExactObservationFromBytes, invalidObservation, normalizeObservationArtifactPath, } from "./long-task-json-pointer-observation.js";
-export async function extractJsonPointerExactObservation(input) {
-    const artifactPath = normalizeObservationArtifactPath(input.artifact_path);
-    const root = path.resolve(input.root);
-    const resolved = path.resolve(root, ...artifactPath.split("/"));
-    assertContained(root, resolved);
-    await rejectSymbolicPath(root, artifactPath);
-    const [rootReal, fileReal] = await Promise.all([
-        realpath(root),
-        realpath(resolved),
-    ]);
-    assertContained(rootReal, fileReal);
-    const before = await lstat(resolved);
-    if (!before.isFile())
-        throw invalidObservation("observation_artifact_not_file");
-    if (before.size > JSON_POINTER_EXACT_LIMITS.max_file_bytes)
-        throw invalidObservation("observation_artifact_size_limit");
-    const handle = await open(resolved, "r");
-    try {
-        const opened = await handle.stat();
-        assertSameFile(before, opened);
-        const bytes = await handle.readFile();
-        const after = await handle.stat();
-        assertSameFile(opened, after);
-        return extractJsonPointerExactObservationFromBytes({
-            artifact_path: artifactPath,
-            bytes,
-            locator: input.locator,
-            sensitivity: input.sensitivity,
-            budget: input.budget,
-        });
-    }
-    finally {
-        await handle.close();
-    }
-}
-function assertContained(root, target) {
-    const relative = path.relative(root, target);
-    if (!relative || relative.startsWith("..") || path.isAbsolute(relative))
-        throw invalidObservation("observation_artifact_path_escape");
-}
-async function rejectSymbolicPath(root, relative) {
-    let current = root;
-    for (const segment of relative.split("/")) {
-        current = path.join(current, segment);
-        const entry = await lstat(current);
-        if (entry.isSymbolicLink())
-            throw invalidObservation("observation_artifact_symlink");
-    }
-}
-function assertSameFile(before, after) {
-    if (before.dev !== after.dev ||
-        before.ino !== after.ino ||
-        before.size !== after.size)
-        throw invalidObservation("observation_artifact_changed_during_read");
-}

package/dist/lib/long-task-observation-authority.d.ts

@@ -1,28 +0,0 @@
-import type { CompiledDesignTargetV2, CompiledObservationAuthorityV2, DeliveryCheckV2, ExecutionTargetV2, FrozenRunnerV2, SemanticFactExpectationV2, SourceBackedExecutionTargetV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
-import type { ScopedDeliveryBindingV2 } from "./long-task-scoped-binding.js";
-interface CompileObservationAuthorityPlanInput {
-    check: DeliveryCheckV2;
-    outcome_key: string | null;
-    runner: FrozenRunnerV2;
-    execution_target: ExecutionTargetV2;
-    design_targets: CompiledDesignTargetV2[];
-    semantic_fact_expectations: SemanticFactExpectationV2[];
-    production_bindings: ScopedDeliveryBindingV2[];
-    production_owner_paths: string[];
-    source_backed_execution_target: SourceBackedExecutionTargetV2 | null;
-    workspace_manifest: WorkspaceManifestV2;
-    protected_authority_paths?: readonly string[];
-    external_design_obligation_refs?: ReadonlySet<string>;
-    external_claim_obligation_refs_by_assertion?: ReadonlyMap<string, string>;
-}
-export declare function compileObservationAuthorityPlan(input: CompileObservationAuthorityPlanInput): CompiledObservationAuthorityV2[];
-export declare function projectExternallyOwnedDesignAssertions(check: DeliveryCheckV2, designTargets: CompiledDesignTargetV2[], machineAuthorities: CompiledObservationAuthorityV2[], externalDesignObligationRefs: ReadonlySet<string>): {
-    check: DeliveryCheckV2;
-    removed_assertion_refs: Set<string>;
-};
-export declare function projectExternallyOwnedClaimAssertions(check: DeliveryCheckV2, observationAuthorities: CompiledObservationAuthorityV2[], externalClaimObligationRefsByAssertion: ReadonlyMap<string, string>): {
-    check: DeliveryCheckV2;
-    removed_assertion_refs: Set<string>;
-};
-export declare function assertionObligationRef(outcomeKey: string | null, checkKey: string, assertionKey: string): string;
-export {};