project-tiny-context-harness 0.2.85 → 0.6.0

package/dist/lib/long-task-playwright-counterfactual-policy.js

@@ -0,0 +1,125 @@
+export function classifyPlaywrightCounterfactual(raw, result, control) {
+    const reasons = [];
+    const expected = [...new Set(control.expected_assertion_failures)].sort();
+    if (expected.length !== control.expected_assertion_failures.length)
+        reasons.push("expected_assertion_failures_duplicate");
+    if (result.evidence_adapter !== "playwright_json_v1")
+        reasons.push("evidence_adapter_not_playwright_json_v1");
+    if (raw.execution_status !== "completed")
+        reasons.push(`execution_status_${raw.execution_status}`);
+    if (raw.exit_code === 0)
+        reasons.push("exit_code_zero_with_test_failure");
+    else if (raw.exit_code !== 1)
+        reasons.push(`exit_code_not_expected_test_failure:${raw.exit_code}`);
+    const reportErrorCount = count(raw.observations, "playwright.report_error_count", reasons);
+    const declaredUnexpectedInstances = count(raw.observations, "playwright.declared_unexpected_instances", reasons);
+    const unboundUnexpectedInstances = count(raw.observations, "playwright.unbound_unexpected_instances", reasons);
+    const reportUnexpectedInstances = count(raw.observations, "playwright.unexpected", reasons);
+    if (reportErrorCount !== null && reportErrorCount !== 0)
+        reasons.push(`playwright_report_errors:${reportErrorCount}`);
+    if (unboundUnexpectedInstances !== null && unboundUnexpectedInstances !== 0)
+        reasons.push(`playwright_unbound_unexpected_instances:${unboundUnexpectedInstances}`);
+    const expectedCaseIds = new Set();
+    let expectedUnexpectedInstances = 0;
+    for (const assertionKey of expected) {
+        const assertion = result.assertion_results.find((item) => item.key === assertionKey);
+        if (!assertion) {
+            reasons.push(`expected_assertion_missing:${assertionKey}`);
+            continue;
+        }
+        const caseId = playwrightCaseId(assertion.observation);
+        if (!caseId) {
+            reasons.push(`expected_assertion_not_playwright_ac:${assertionKey}`);
+            continue;
+        }
+        if (expectedCaseIds.has(caseId))
+            reasons.push(`expected_playwright_ac_duplicate:${caseId}`);
+        expectedCaseIds.add(caseId);
+        const prefix = `playwright.case.${caseId}`;
+        if (boolean(raw.observations, `${prefix}.executed`) !== true)
+            reasons.push(`expected_playwright_ac_not_executed:${caseId}`);
+        if (boolean(raw.observations, `${prefix}.unexpected`) !== true)
+            reasons.push(`expected_playwright_ac_not_unexpected:${caseId}`);
+        if (boolean(raw.observations, `${prefix}.skipped`) !== false)
+            reasons.push(`expected_playwright_ac_skipped:${caseId}`);
+        if (boolean(raw.observations, `${prefix}.flaky`) !== false)
+            reasons.push(`expected_playwright_ac_flaky:${caseId}`);
+        const unexpectedInstances = count(raw.observations, `${prefix}.unexpected_instances`, reasons);
+        const timedOutInstances = count(raw.observations, `${prefix}.timed_out_instances`, reasons);
+        const interruptedInstances = count(raw.observations, `${prefix}.interrupted_instances`, reasons);
+        if (unexpectedInstances !== null) {
+            expectedUnexpectedInstances += unexpectedInstances;
+            if (unexpectedInstances === 0)
+                reasons.push(`expected_playwright_ac_has_no_unexpected_instance:${caseId}`);
+        }
+        if (timedOutInstances !== null && timedOutInstances !== 0)
+            reasons.push(`expected_playwright_ac_timed_out:${caseId}`);
+        if (interruptedInstances !== null && interruptedInstances !== 0)
+            reasons.push(`expected_playwright_ac_interrupted:${caseId}`);
+        if (assertion.passed || assertion.status !== "assertion_value_mismatch")
+            reasons.push(`expected_assertion_not_value_mismatch:${assertionKey}`);
+    }
+    for (const assertion of result.assertion_results)
+        if (!expected.includes(assertion.key) && !assertion.passed)
+            reasons.push(`unspecified_assertion_failed:${assertion.key}`);
+    if (declaredUnexpectedInstances !== null &&
+        declaredUnexpectedInstances !== expectedUnexpectedInstances)
+        reasons.push(`declared_unexpected_instance_mismatch:${declaredUnexpectedInstances}:${expectedUnexpectedInstances}`);
+    if (reportUnexpectedInstances !== null &&
+        reportUnexpectedInstances !== expectedUnexpectedInstances)
+        reasons.push(`report_unexpected_instance_mismatch:${reportUnexpectedInstances}:${expectedUnexpectedInstances}`);
+    const genericTestFailures = result.findings.filter((finding) => finding.code === "test_failed" && !finding.assertion_key);
+    if (genericTestFailures.length !== 1)
+        reasons.push(`generic_test_failure_count_unexpected:${genericTestFailures.length}`);
+    for (const finding of result.findings) {
+        const expectedAcceptanceFailure = finding.code === "acceptance_case_unexpected" &&
+            Boolean(finding.assertion_key) &&
+            expected.includes(finding.assertion_key);
+        const genericTestFailure = finding.code === "test_failed" && !finding.assertion_key;
+        if (!expectedAcceptanceFailure && !genericTestFailure)
+            reasons.push(`unexplained_finding:${finding.code}:${finding.assertion_key ?? "none"}`);
+    }
+    for (const assertionKey of expected)
+        if (!result.findings.some((finding) => finding.code === "acceptance_case_unexpected" &&
+            finding.assertion_key === assertionKey))
+            reasons.push(`expected_acceptance_failure_missing:${assertionKey}`);
+    const rejectionReasons = [...new Set(reasons)].sort();
+    if (rejectionReasons.length)
+        return {
+            accepted_test_failure_exit: false,
+            normalized_result: result,
+            rejection_reasons: rejectionReasons,
+        };
+    return {
+        accepted_test_failure_exit: true,
+        normalized_result: {
+            ...result,
+            status: "assertion_failed",
+            claim_proofs: [],
+            findings: result.findings
+                .filter((finding) => !(finding.code === "test_failed" && !finding.assertion_key))
+                .map((finding) => finding.code === "acceptance_case_unexpected" &&
+                finding.assertion_key &&
+                expected.includes(finding.assertion_key)
+                ? { ...finding, code: "assertion_value_mismatch" }
+                : finding),
+        },
+        rejection_reasons: [],
+    };
+}
+function playwrightCaseId(observation) {
+    return (/^playwright\.case\.([a-z0-9][a-z0-9-]*)\.passed$/u.exec(observation)?.[1] ?? null);
+}
+function count(observations, key, reasons) {
+    const value = observations[key];
+    if (!Number.isInteger(value) || Number(value) < 0) {
+        reasons.push(`playwright_diagnostic_count_invalid:${key}`);
+        return null;
+    }
+    return Number(value);
+}
+function boolean(observations, key) {
+    return typeof observations[key] === "boolean"
+        ? observations[key]
+        : null;
+}

package/dist/lib/long-task-playwright-evidence.d.ts

@@ -0,0 +1,6 @@
+import type { CompiledCheckV2 } from "./long-task-delivery-types.js";
+export interface PlaywrightEvidence {
+    observations: Record<string, unknown>;
+    error: string | null;
+}
+export declare function extractPlaywrightEvidence(check: CompiledCheckV2, report: Record<string, unknown>, exitCode: number): PlaywrightEvidence;

package/dist/lib/long-task-playwright-evidence.js

@@ -0,0 +1,244 @@
+export function extractPlaywrightEvidence(check, report, exitCode) {
+    const stats = record(report.stats);
+    if (!stats)
+        return invalid("playwright_report_invalid:stats");
+    const expected = integer(stats.expected);
+    const unexpected = integer(stats.unexpected);
+    const skipped = integer(stats.skipped);
+    const flaky = integer(stats.flaky);
+    if ([expected, unexpected, skipped, flaky].some((value) => value === null))
+        return invalid("playwright_report_invalid:counts");
+    const total = expected + unexpected + skipped + flaky;
+    const reportErrors = report.errors;
+    if (reportErrors !== undefined && !Array.isArray(reportErrors))
+        return invalid("playwright_report_invalid:errors");
+    const observations = {
+        "playwright.passed": exitCode === 0,
+        "playwright.expected": expected,
+        "playwright.unexpected": unexpected,
+        "playwright.skipped": skipped,
+        "playwright.flaky": flaky,
+        "playwright.total": total,
+        "playwright.zero_or_all_skipped": total === 0 || skipped === total,
+        "playwright.report_error_count": Array.isArray(reportErrors)
+            ? reportErrors.length
+            : 0,
+    };
+    const collected = collectCases(report, declaredCaseIds(check));
+    if (collected.error)
+        return invalid(collected.error);
+    const instances = collected.cases;
+    observations["playwright.declared_unexpected_instances"] = instances.filter((item) => item.unexpected).length;
+    observations["playwright.unbound_unexpected_instances"] =
+        collected.unbound_unexpected_instances;
+    const duplicate = duplicateCaseInstance(instances);
+    if (duplicate)
+        return invalid(`playwright_ac_id_duplicate:${duplicate.id}:${duplicate.project_id}`);
+    const cases = aggregateCases(instances);
+    for (const item of cases) {
+        const prefix = `playwright.case.${item.id}`;
+        observations[`${prefix}.executed`] = item.executed;
+        observations[`${prefix}.passed`] = item.passed;
+        observations[`${prefix}.skipped`] = item.skipped;
+        observations[`${prefix}.flaky`] = item.flaky;
+        observations[`${prefix}.unexpected`] = item.unexpected;
+        observations[`${prefix}.status`] = item.status;
+        observations[`${prefix}.project_ids`] = item.project_ids;
+        observations[`${prefix}.executed_instances`] = item.executed_instances;
+        observations[`${prefix}.failed_instances`] = item.failed_instances;
+        observations[`${prefix}.skipped_instances`] = item.skipped_instances;
+        observations[`${prefix}.flaky_instances`] = item.flaky_instances;
+        observations[`${prefix}.unexpected_instances`] = item.unexpected_instances;
+        observations[`${prefix}.timed_out_instances`] = item.timed_out_instances;
+        observations[`${prefix}.interrupted_instances`] =
+            item.interrupted_instances;
+    }
+    for (const id of declaredCaseIds(check)) {
+        const prefix = `playwright.case.${id}`;
+        if (!Object.hasOwn(observations, `${prefix}.status`)) {
+            observations[`${prefix}.executed`] = false;
+            observations[`${prefix}.status`] = "missing";
+        }
+    }
+    observations["playwright.case_ids"] = cases.map((item) => item.id).sort();
+    return { observations, error: null };
+}
+function collectCases(report, declaredIds) {
+    const cases = [];
+    const collection = { unbound_unexpected_instances: 0 };
+    const error = visitSuites(report.suites, cases, declaredIds, collection);
+    return { cases, error, ...collection };
+}
+function visitSuites(value, cases, declaredIds, collection) {
+    if (!Array.isArray(value))
+        return null;
+    for (const suiteValue of value) {
+        const suite = record(suiteValue);
+        if (!suite)
+            continue;
+        const nestedError = visitSuites(suite.suites, cases, declaredIds, collection);
+        if (nestedError)
+            return nestedError;
+        if (!Array.isArray(suite.specs))
+            continue;
+        for (const specValue of suite.specs) {
+            const spec = record(specValue);
+            if (!spec || !Array.isArray(spec.tests))
+                continue;
+            for (const testValue of spec.tests) {
+                const test = record(testValue);
+                if (!test)
+                    continue;
+                const title = [spec.title, test.title]
+                    .filter((item) => typeof item === "string")
+                    .join(" ");
+                const ids = declaredIdsInTitle(title, declaredIds);
+                if (ids.length > 1)
+                    return `playwright_test_multiple_ac_ids:${ids.join(",")}`;
+                const instance = playwrightCase(ids[0] ?? "unbound", test);
+                if (ids.length === 1)
+                    cases.push(instance);
+                else if (instance.unexpected)
+                    collection.unbound_unexpected_instances += 1;
+            }
+        }
+    }
+    return null;
+}
+function declaredIdsInTitle(title, declared) {
+    const explicit = [...title.matchAll(/\[ac:([a-z0-9][a-z0-9-]*)\]/gu)].map((match) => match[1]);
+    const legacy = [...title.matchAll(/\[([a-z0-9][a-z0-9-]*)\]/gu)].map((match) => match[1]);
+    return [
+        ...new Set([...explicit, ...legacy].filter((id) => declared.has(id))),
+    ].sort();
+}
+function playwrightCase(id, test) {
+    const status = typeof test.status === "string" ? test.status : "invalid";
+    const projectId = typeof test.projectId === "string"
+        ? test.projectId
+        : typeof test.projectName === "string"
+            ? test.projectName
+            : "default";
+    const results = Array.isArray(test.results)
+        ? test.results.map(record).filter(Boolean)
+        : [];
+    const resultStatuses = results
+        .map((result) => result.status)
+        .filter((value) => typeof value === "string");
+    const skipped = status === "skipped" ||
+        (resultStatuses.length > 0 &&
+            resultStatuses.every((value) => value === "skipped"));
+    const executed = !skipped && resultStatuses.length > 0;
+    const flaky = status === "flaky";
+    const unexpected = status === "unexpected";
+    const timedOut = resultStatuses.includes("timedOut");
+    const interrupted = resultStatuses.includes("interrupted");
+    const passed = executed &&
+        !flaky &&
+        !unexpected &&
+        status === "expected" &&
+        resultStatuses.length > 0 &&
+        resultStatuses.at(-1) === "passed";
+    return {
+        id,
+        project_id: projectId,
+        executed,
+        passed,
+        skipped,
+        flaky,
+        unexpected,
+        timed_out: timedOut,
+        interrupted,
+        status,
+    };
+}
+function declaredCaseIds(check) {
+    const result = new Set();
+    for (const assertion of [
+        ...check.positive_assertions,
+        ...check.negative_assertions,
+    ]) {
+        if (!assertion.claims.length)
+            continue;
+        const match = /^playwright\.case\.([a-z0-9][a-z0-9-]*)\.passed$/u.exec(assertion.observation);
+        if (match)
+            result.add(assertion.key);
+    }
+    return result;
+}
+function duplicateCaseInstance(values) {
+    const seen = new Set();
+    for (const value of values) {
+        const identity = `${value.id}\0${value.project_id}`;
+        if (seen.has(identity))
+            return value;
+        seen.add(identity);
+    }
+    return null;
+}
+function aggregateCases(instances) {
+    const grouped = new Map();
+    for (const instance of instances) {
+        const rows = grouped.get(instance.id) ?? [];
+        rows.push(instance);
+        grouped.set(instance.id, rows);
+    }
+    return [...grouped.entries()]
+        .map(([id, rows]) => {
+        const executedInstances = rows.filter((item) => item.executed).length;
+        const skippedInstances = rows.filter((item) => item.skipped).length;
+        const flakyInstances = rows.filter((item) => item.flaky).length;
+        const unexpectedInstances = rows.filter((item) => item.unexpected).length;
+        const timedOutInstances = rows.filter((item) => item.timed_out).length;
+        const interruptedInstances = rows.filter((item) => item.interrupted).length;
+        const failedInstances = rows.filter((item) => !item.passed && !item.skipped).length;
+        const executed = rows.length > 0 && rows.every((item) => item.executed);
+        const passed = executed &&
+            skippedInstances === 0 &&
+            flakyInstances === 0 &&
+            unexpectedInstances === 0 &&
+            rows.every((item) => item.passed);
+        const status = passed
+            ? "passed"
+            : skippedInstances
+                ? "skipped"
+                : flakyInstances
+                    ? "flaky"
+                    : timedOutInstances
+                        ? "timed_out"
+                        : interruptedInstances
+                            ? "interrupted"
+                            : unexpectedInstances
+                                ? "unexpected"
+                                : "failed";
+        return {
+            id,
+            executed,
+            passed,
+            skipped: skippedInstances > 0,
+            flaky: flakyInstances > 0,
+            unexpected: unexpectedInstances > 0,
+            status,
+            project_ids: rows.map((item) => item.project_id).sort(),
+            executed_instances: executedInstances,
+            failed_instances: failedInstances,
+            skipped_instances: skippedInstances,
+            flaky_instances: flakyInstances,
+            unexpected_instances: unexpectedInstances,
+            timed_out_instances: timedOutInstances,
+            interrupted_instances: interruptedInstances,
+        };
+    })
+        .sort((left, right) => left.id.localeCompare(right.id));
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function integer(value) {
+    return Number.isInteger(value) && Number(value) >= 0 ? Number(value) : null;
+}
+function invalid(error) {
+    return { observations: {}, error };
+}

package/dist/lib/long-task-product-shape.d.ts

@@ -0,0 +1,6 @@
+import type { DeliveryControlV2, DeliveryObligationV2, DeliveryOwnerV2, KeyedPathV2, KeyedStatementV2 } from "./long-task-delivery-types.js";
+export declare function parseKeyedStatements(value: unknown, label: string): KeyedStatementV2[];
+export declare function parseKeyedPaths(value: unknown, label: string): KeyedPathV2[];
+export declare function parseControls(value: unknown, label: string): DeliveryControlV2[];
+export declare function parseOwner(value: unknown, label: string): DeliveryOwnerV2;
+export declare function parseObligations(value: unknown, label: string): DeliveryObligationV2[];

package/dist/lib/long-task-product-shape.js

@@ -0,0 +1,73 @@
+import { parseRequiredProofSurfaces } from "./long-task-required-proof-surfaces.js";
+import { array, key, object, repositoryFiles, repositoryPattern, repositoryPatterns, string, text, } from "./long-task-shape-primitives.js";
+export function parseKeyedStatements(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, ["key", "statement"]);
+        return {
+            key: key(row.key, `${itemLabel}.key`),
+            statement: string(row.statement, `${itemLabel}.statement`),
+        };
+    });
+}
+export function parseKeyedPaths(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, ["key", "path"]);
+        return {
+            key: key(row.key, `${itemLabel}.key`),
+            path: repositoryPattern(row.path, `${itemLabel}.path`),
+        };
+    });
+}
+export function parseControls(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, ["key", "location"], [
+            "trigger",
+            "input",
+            "loading_state",
+            "empty_state",
+            "success_state",
+            "failure_state",
+            "feedback",
+        ]);
+        return {
+            key: key(row.key, `${itemLabel}.key`),
+            location: string(row.location, `${itemLabel}.location`),
+            trigger: optionalText(row, "trigger", itemLabel),
+            input: optionalText(row, "input", itemLabel),
+            loading_state: optionalText(row, "loading_state", itemLabel),
+            empty_state: optionalText(row, "empty_state", itemLabel),
+            success_state: optionalText(row, "success_state", itemLabel),
+            failure_state: optionalText(row, "failure_state", itemLabel),
+            feedback: optionalText(row, "feedback", itemLabel),
+        };
+    });
+}
+export function parseOwner(value, label) {
+    const row = object(value, label, ["label", "context_refs", "path_globs"]);
+    return {
+        label: string(row.label, `${label}.label`),
+        context_refs: repositoryFiles(row.context_refs, `${label}.context_refs`),
+        path_globs: repositoryPatterns(row.path_globs, `${label}.path_globs`),
+    };
+}
+export function parseObligations(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, [
+            "key",
+            "statement",
+            "required_proof_surfaces",
+        ]);
+        return {
+            key: key(row.key, `${itemLabel}.key`),
+            statement: string(row.statement, `${itemLabel}.statement`),
+            required_proof_surfaces: parseRequiredProofSurfaces(row.required_proof_surfaces, `${itemLabel}.required_proof_surfaces`),
+        };
+    });
+}
+function optionalText(row, field, label) {
+    return Object.hasOwn(row, field) ? text(row[field], `${label}.${field}`) : "";
+}

package/dist/lib/long-task-progress.d.ts

@@ -0,0 +1,4 @@
+import type { CheckExecutionResultV2, CompiledCheckV2, CompiledDeliveryContractV2, ProgressRecordV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
+export declare function createProgressRecord(compiled: CompiledDeliveryContractV2, manifest: WorkspaceManifestV2, check: CompiledCheckV2, result: CheckExecutionResultV2): ProgressRecordV2;
+export declare function progressRecordFresh(record: ProgressRecordV2, compiled: CompiledDeliveryContractV2, manifest: WorkspaceManifestV2, check: CompiledCheckV2): boolean;
+export declare function checkIdentity(check: CompiledCheckV2): string;

package/dist/lib/long-task-progress.js

@@ -0,0 +1,114 @@
+import { outcomeAuthorityHash } from "./long-task-authority.js";
+import { contextAuthorityProjection } from "./long-task-context-authority.js";
+import { matchesRepoPattern } from "./long-task-paths.js";
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+export function createProgressRecord(compiled, manifest, check, result) {
+    const outcome = check.outcome_key
+        ? (compiled.outcomes.find((item) => item.key === check.outcome_key) ?? null)
+        : null;
+    return {
+        schema_version: "long-task-progress-record-v2",
+        compiled_identity: compiled.compiled_identity,
+        outcome_authority_hash: progressAuthorityHash(compiled, outcome ?? null),
+        check_identity: checkIdentity(check),
+        check_internal_id: check.internal_id,
+        outcome_key: check.outcome_key,
+        check_key: check.key,
+        runner_verifier_identity: runnerVerifierIdentity(compiled, check),
+        relevant_context_identity: contextIdentity(compiled),
+        resolved_input_path_hashes: hashPatterns(manifest, check.input_paths),
+        binding_carrier_path_hashes: hashPatterns(manifest, progressBindingCarrierPatterns(compiled, check, outcome)),
+        dependency_interface_identities: dependencyInterfaceIdentities(compiled, manifest, outcome?.depends_on ?? []),
+        result: result.status,
+        check_result: result,
+        findings: result.findings,
+        completed_at: new Date().toISOString(),
+    };
+}
+export function progressRecordFresh(record, compiled, manifest, check) {
+    const outcome = check.outcome_key
+        ? (compiled.outcomes.find((item) => item.key === check.outcome_key) ?? null)
+        : null;
+    const expectedOutcomeAuthority = progressAuthorityHash(compiled, outcome ?? null);
+    return (record.check_internal_id === check.internal_id &&
+        record.check_identity === checkIdentity(check) &&
+        record.outcome_authority_hash === expectedOutcomeAuthority &&
+        record.runner_verifier_identity ===
+            runnerVerifierIdentity(compiled, check) &&
+        record.relevant_context_identity === contextIdentity(compiled) &&
+        same(record.resolved_input_path_hashes, hashPatterns(manifest, check.input_paths)) &&
+        same(record.binding_carrier_path_hashes, hashPatterns(manifest, progressBindingCarrierPatterns(compiled, check, outcome))) &&
+        same(record.dependency_interface_identities, dependencyInterfaceIdentities(compiled, manifest, outcome?.depends_on ?? [])));
+}
+function progressBindingCarrierPatterns(compiled, check, outcome) {
+    if (outcome)
+        return outcome.technical.bindings.flatMap((binding) => binding.carrier_paths);
+    const references = (compiled.global.acceptance.counterfactual_controls ?? [])
+        .filter((control) => control.check_key === check.key)
+        .map((control) => control.binding_ref);
+    return references.flatMap((reference) => {
+        const [outcomeKey, bindingKey] = reference.split(".");
+        return (compiled.outcomes
+            .find((item) => item.key === outcomeKey)
+            ?.technical.bindings.find((binding) => binding.key === bindingKey)
+            ?.carrier_paths ?? []);
+    });
+}
+function progressAuthorityHash(compiled, outcome) {
+    return sha256Hex(canonicalValueJson({
+        source: compiled.authority_hashes.source_authority_hash,
+        product: compiled.authority_hashes.product_authority_hash,
+        acceptance: compiled.authority_hashes.acceptance_authority_hash,
+        risk: compiled.authority_hashes.risk_authority_hash,
+        outcome: outcome ? outcomeAuthorityHash(outcome) : null,
+    }));
+}
+export function checkIdentity(check) {
+    return sha256Hex(canonicalValueJson({
+        internal_id: check.internal_id,
+        proof_surface: check.proof_surface,
+        evidence_adapter: check.evidence_adapter,
+        runner: check.runner.execution_identity,
+        raw_execution: check.raw_execution_identity,
+        verification_input_hashes: check.verification_input_hashes,
+        input_paths: check.input_paths,
+        expected_output_paths: check.expected_output_paths,
+        artifact_globs: check.artifact_globs,
+        positive_assertions: check.positive_assertions,
+        negative_assertions: check.negative_assertions,
+        environment_requirements: check.environment_requirements,
+    }));
+}
+function runnerVerifierIdentity(compiled, check) {
+    return sha256Hex(canonicalValueJson({
+        runner: check.raw_execution_identity,
+        verifier: compiled.verifier_identity.bundle_sha256,
+    }));
+}
+function contextIdentity(compiled) {
+    return sha256Hex(canonicalValueJson(contextAuthorityProjection(compiled.context_snapshot)));
+}
+function dependencyInterfaceIdentities(compiled, manifest, dependencies) {
+    const result = {};
+    for (const key of dependencies) {
+        const dependency = compiled.outcomes.find((outcome) => outcome.key === key);
+        if (!dependency)
+            continue;
+        result[key] = sha256Hex(canonicalValueJson({
+            authority: outcomeAuthorityHash(dependency),
+            carriers: hashPatterns(manifest, dependency.technical.bindings.flatMap((binding) => binding.carrier_paths)),
+        }));
+    }
+    return Object.fromEntries(Object.entries(result).sort(([a], [b]) => a.localeCompare(b)));
+}
+function hashPatterns(manifest, patterns) {
+    const result = {};
+    for (const pattern of patterns)
+        for (const file of manifest.files)
+            if (matchesRepoPattern(file.path, pattern))
+                result[file.path] = file.sha256;
+    return Object.fromEntries(Object.entries(result).sort(([a], [b]) => a.localeCompare(b)));
+}
+function same(left, right) {
+    return canonicalValueJson(left) === canonicalValueJson(right);
+}

package/dist/lib/long-task-protected-files.d.ts

@@ -0,0 +1 @@
+export declare function assertProtectedRepositoryFile(repositoryInput: string, fileInput: string, label: string): Promise<string>;

package/dist/lib/long-task-protected-files.js

@@ -0,0 +1,30 @@
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+export async function assertProtectedRepositoryFile(repositoryInput, fileInput, label) {
+    const repositoryPath = path.resolve(repositoryInput);
+    const repository = await realpath(repositoryPath);
+    const candidate = path.resolve(fileInput);
+    assertInside(repositoryPath, candidate, label, fileInput);
+    const info = await lstat(candidate).catch(() => null);
+    if (!info)
+        throw new Error(`protected_input_not_found:${label}:${display(fileInput)}`);
+    if (info.isSymbolicLink())
+        throw new Error(`protected_input_symlink_not_allowed:${label}:${display(fileInput)}`);
+    if (!info.isFile())
+        throw new Error(`protected_input_not_regular_file:${label}:${display(fileInput)}`);
+    const resolved = await realpath(candidate);
+    assertInside(repository, resolved, label, fileInput);
+    if (typeof info.nlink === "number" && info.nlink > 1)
+        throw new Error(`protected_input_hardlink_not_allowed:${label}:${display(fileInput)}`);
+    return resolved;
+}
+function assertInside(repository, candidate, label, original) {
+    const relative = path.relative(repository, candidate);
+    if (relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative))
+        throw new Error(`protected_input_realpath_outside_repository:${label}:${display(original)}`);
+}
+function display(file) {
+    return file.replace(/\\/gu, "/");
+}

package/dist/lib/long-task-required-proof-surfaces.d.ts

@@ -0,0 +1,2 @@
+import type { ProofSurface } from "./long-task-delivery-types.js";
+export declare function parseRequiredProofSurfaces(value: unknown, label: string): ProofSurface[];

package/dist/lib/long-task-required-proof-surfaces.js

@@ -0,0 +1,13 @@
+import { array, fail, literal, PROOF_SURFACES, } from "./long-task-shape-primitives.js";
+export function parseRequiredProofSurfaces(value, label) {
+    const surfaces = array(value, label).map((surface, index) => literal(surface, PROOF_SURFACES, `${label}[${index}]`));
+    if (!surfaces.length)
+        fail("required_proof_surfaces_empty", label);
+    const seen = new Set();
+    for (const surface of surfaces) {
+        if (seen.has(surface))
+            fail("required_proof_surface_duplicate", `${label}:${surface}`);
+        seen.add(surface);
+    }
+    return surfaces;
+}

package/dist/lib/long-task-requirement-shape.d.ts

@@ -0,0 +1,2 @@
+import type { DeliveryOutcomeV2 } from "./long-task-delivery-types.js";
+export declare function parseRequirements(value: unknown, label: string): DeliveryOutcomeV2["product"]["requirements"];

package/dist/lib/long-task-requirement-shape.js

@@ -0,0 +1,18 @@
+import { parseRequiredProofSurfaces } from "./long-task-required-proof-surfaces.js";
+import { array, key, object, string } from "./long-task-shape-primitives.js";
+export function parseRequirements(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const row = object(item, itemLabel, [
+            "key",
+            "statement",
+            "required_proof_surfaces",
+        ]);
+        const surfaces = parseRequiredProofSurfaces(row.required_proof_surfaces, `${itemLabel}.required_proof_surfaces`);
+        return {
+            key: key(row.key, `${itemLabel}.key`),
+            statement: string(row.statement, `${itemLabel}.statement`),
+            required_proof_surfaces: surfaces,
+        };
+    });
+}

package/dist/lib/long-task-risk-surfaces.d.ts

@@ -0,0 +1,2 @@
+import type { DeliveryContractV2 } from "./long-task-delivery-types.js";
+export declare function validateActualRiskSurfaces(repository: string, changedPaths: string[], contract: DeliveryContractV2): Promise<void>;