project-tiny-context-harness 0.8.11 → 0.8.13

package/dist/lib/design-resource-symbolic-noninterference-shape.js

@@ -0,0 +1,152 @@
+import { nonnegativeInteger, sha256, stableKey, stableKeys, } from "./design-resource-handoff-shape-primitives.js";
+import { parseSymbolicPredicate } from "./design-resource-symbolic-predicate-shape.js";
+import { array, literal, nullable, object, string, } from "./long-task-shape-primitives.js";
+export function parseSymbolicNoninterferenceProof(value, label) {
+    const row = object(value, label, [
+        "side",
+        "method",
+        "input_resource_refs",
+        "oracle_ref",
+        "environment_ref",
+        "static_dependency_nodes",
+        "static_rule_roots",
+        "equivalence_cases",
+        "dynamic_dependency_kinds",
+        "external_device_refs",
+        "complete_domain_cardinality",
+        "oracle_version",
+        "oracle_implementation_sha256",
+        "oracle_capability",
+        "environment_sha256",
+        "input_snapshot_sha256",
+        "source_manifest_snapshot_sha256",
+        "target_snapshot_sha256",
+        "certificate_scope_sha256",
+        "rule_scope_sha256",
+        "omitted_axis_refs",
+        "method_result_sha256",
+        "artifact_resource_ref",
+        "artifact_path",
+        "artifact_sha256",
+        "failure_witness",
+    ]);
+    return {
+        side: literal(row.side, ["source", "production"], `${label}.side`),
+        method: literal(row.method, [
+            "closed_world_static_dependency_closure",
+            "restricted_ir_symbolic_equivalence",
+            "finite_complete_domain_exhaustive_equivalence",
+        ], `${label}.method`),
+        input_resource_refs: stableKeys(row.input_resource_refs, `${label}.input_resource_refs`),
+        oracle_ref: stableKey(row.oracle_ref, `${label}.oracle_ref`),
+        environment_ref: stableKey(row.environment_ref, `${label}.environment_ref`),
+        static_dependency_nodes: array(row.static_dependency_nodes, `${label}.static_dependency_nodes`).map((item, index) => parseStaticDependencyNode(item, `${label}.static_dependency_nodes[${index}]`)),
+        static_rule_roots: array(row.static_rule_roots, `${label}.static_rule_roots`).map((item, index) => parseStaticDependencyRoot(item, `${label}.static_rule_roots[${index}]`)),
+        equivalence_cases: array(row.equivalence_cases, `${label}.equivalence_cases`).map((item, index) => {
+            const itemLabel = `${label}.equivalence_cases[${index}]`;
+            const entry = object(item, itemLabel, [
+                "fact_rule_refs",
+                "side_predicate",
+                "axis_erased_predicate",
+            ]);
+            return {
+                fact_rule_refs: stableKeys(entry.fact_rule_refs, `${itemLabel}.fact_rule_refs`),
+                side_predicate: parseSymbolicPredicate(entry.side_predicate, `${itemLabel}.side_predicate`),
+                axis_erased_predicate: parseSymbolicPredicate(entry.axis_erased_predicate, `${itemLabel}.axis_erased_predicate`),
+            };
+        }),
+        dynamic_dependency_kinds: stableKeys(row.dynamic_dependency_kinds, `${label}.dynamic_dependency_kinds`),
+        external_device_refs: stableKeys(row.external_device_refs, `${label}.external_device_refs`),
+        complete_domain_cardinality: nullable(row.complete_domain_cardinality, (entry) => decimalCardinality(entry, `${label}.complete_domain_cardinality`)),
+        oracle_version: string(row.oracle_version, `${label}.oracle_version`),
+        oracle_implementation_sha256: sha256(row.oracle_implementation_sha256, `${label}.oracle_implementation_sha256`),
+        oracle_capability: string(row.oracle_capability, `${label}.oracle_capability`),
+        environment_sha256: sha256(row.environment_sha256, `${label}.environment_sha256`),
+        input_snapshot_sha256: sha256(row.input_snapshot_sha256, `${label}.input_snapshot_sha256`),
+        source_manifest_snapshot_sha256: nullable(row.source_manifest_snapshot_sha256, (entry) => sha256(entry, `${label}.source_manifest_snapshot_sha256`)),
+        target_snapshot_sha256: sha256(row.target_snapshot_sha256, `${label}.target_snapshot_sha256`),
+        certificate_scope_sha256: sha256(row.certificate_scope_sha256, `${label}.certificate_scope_sha256`),
+        rule_scope_sha256: sha256(row.rule_scope_sha256, `${label}.rule_scope_sha256`),
+        omitted_axis_refs: stableKeys(row.omitted_axis_refs, `${label}.omitted_axis_refs`),
+        method_result_sha256: sha256(row.method_result_sha256, `${label}.method_result_sha256`),
+        artifact_resource_ref: stableKey(row.artifact_resource_ref, `${label}.artifact_resource_ref`),
+        artifact_path: string(row.artifact_path, `${label}.artifact_path`),
+        artifact_sha256: sha256(row.artifact_sha256, `${label}.artifact_sha256`),
+        failure_witness: nullable(row.failure_witness, (entry) => parseFailureWitness(entry, `${label}.failure_witness`)),
+    };
+}
+function parseFailureWitness(value, label) {
+    const row = object(value, label, [
+        "kind",
+        "side",
+        "certificate_scope_sha256",
+        "axis_ref",
+        "fact_rule_ref",
+        "resource_ref",
+        "path",
+        "locator",
+        "node_ref",
+        "byte_offset",
+        "assignment",
+        "detail",
+    ]);
+    return {
+        kind: literal(row.kind, [
+            "omitted_axis_dependency",
+            "unsupported_dependency",
+            "source_rule_denotation_mismatch",
+            "complete_domain_counterexample",
+        ], `${label}.kind`),
+        side: literal(row.side, ["source", "production"], `${label}.side`),
+        certificate_scope_sha256: sha256(row.certificate_scope_sha256, `${label}.certificate_scope_sha256`),
+        axis_ref: nullable(row.axis_ref, (entry) => stableKey(entry, `${label}.axis_ref`)),
+        fact_rule_ref: nullable(row.fact_rule_ref, (entry) => stableKey(entry, `${label}.fact_rule_ref`)),
+        resource_ref: nullable(row.resource_ref, (entry) => stableKey(entry, `${label}.resource_ref`)),
+        path: nullable(row.path, (entry) => string(entry, `${label}.path`)),
+        locator: nullable(row.locator, (entry) => string(entry, `${label}.locator`)),
+        node_ref: nullable(row.node_ref, (entry) => stableKey(entry, `${label}.node_ref`)),
+        byte_offset: nullable(row.byte_offset, (entry) => nonnegativeInteger(entry, `${label}.byte_offset`)),
+        assignment: nullable(row.assignment, (entry) => parseAssignment(entry, `${label}.assignment`)),
+        detail: string(row.detail, `${label}.detail`),
+    };
+}
+function parseAssignment(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label}: must be an object`);
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        stableKey(key, `${label}.key`);
+        if ((typeof entry !== "string" && typeof entry !== "number") ||
+            (typeof entry === "number" && !Number.isFinite(entry)))
+            throw new Error(`${label}.${key}: must be a finite scalar`);
+        result[key] = entry;
+    }
+    return result;
+}
+function parseStaticDependencyNode(value, label) {
+    const row = object(value, label, [
+        "key",
+        "axis_refs",
+        "dependency_refs",
+        "input_resource_refs",
+    ]);
+    return {
+        key: stableKey(row.key, `${label}.key`),
+        axis_refs: stableKeys(row.axis_refs, `${label}.axis_refs`),
+        dependency_refs: stableKeys(row.dependency_refs, `${label}.dependency_refs`),
+        input_resource_refs: stableKeys(row.input_resource_refs, `${label}.input_resource_refs`),
+    };
+}
+function parseStaticDependencyRoot(value, label) {
+    const row = object(value, label, ["fact_rule_refs", "node_ref"]);
+    return {
+        fact_rule_refs: nullable(row.fact_rule_refs, (entry) => stableKeys(entry, `${label}.fact_rule_refs`)),
+        node_ref: stableKey(row.node_ref, `${label}.node_ref`),
+    };
+}
+function decimalCardinality(value, label) {
+    const parsed = string(value, label);
+    if (!/^(?:0|[1-9][0-9]*)$/u.test(parsed))
+        throw new Error(`${label}: must be a canonical nonnegative decimal`);
+    return parsed;
+}

package/dist/lib/design-resource-symbolic-noninterference-types.d.ts

@@ -0,0 +1,103 @@
+import type { SymbolicDenotationPredicate, SymbolicDenotationScalar } from "./symbolic-denotation-types.js";
+export interface DesignResourceSymbolicNoninterferenceCertificateV2 {
+    key: string;
+    fact_rule_refs: string[];
+    omitted_axis_refs: string[];
+    dependency_edge_refs: string[];
+    canonical_rule_dag_sha256: string;
+    source_noninterference_proof?: DesignResourceSymbolicNoninterferenceProofV2 | null;
+    production_noninterference_proof?: DesignResourceSymbolicNoninterferenceProofV2 | null;
+}
+export type DesignResourceSymbolicNoninterferenceProofMethodV2 = "closed_world_static_dependency_closure" | "restricted_ir_symbolic_equivalence" | "finite_complete_domain_exhaustive_equivalence";
+export interface DesignResourceSymbolicNoninterferenceEquivalenceCaseV2 {
+    fact_rule_refs: string[];
+    side_predicate: SymbolicDenotationPredicate;
+    axis_erased_predicate: SymbolicDenotationPredicate;
+}
+export interface DesignResourceSymbolicStaticDependencyNodeV2 {
+    key: string;
+    axis_refs: string[];
+    dependency_refs: string[];
+    input_resource_refs: string[];
+}
+export interface DesignResourceSymbolicStaticDependencyRootV2 {
+    fact_rule_refs: string[] | null;
+    node_ref: string;
+}
+export interface DesignResourceSymbolicNoninterferenceFailureWitnessV1 {
+    kind: "omitted_axis_dependency" | "unsupported_dependency" | "source_rule_denotation_mismatch" | "complete_domain_counterexample";
+    side: "source" | "production";
+    certificate_scope_sha256: string;
+    axis_ref: string | null;
+    fact_rule_ref: string | null;
+    resource_ref: string | null;
+    path: string | null;
+    locator: string | null;
+    node_ref: string | null;
+    byte_offset: number | null;
+    assignment: Record<string, SymbolicDenotationScalar> | null;
+    detail: string;
+}
+export interface DesignResourceSymbolicNoninterferenceInputBindingV2 {
+    resource_ref: string;
+    path: string;
+    declared_sha256: string;
+    current_sha256: string;
+}
+export interface DesignResourceSymbolicNoninterferenceDerivedResultV2 {
+    source_ir_resource_ref: string | null;
+    static_dependency_nodes: DesignResourceSymbolicStaticDependencyNodeV2[];
+    static_rule_roots: DesignResourceSymbolicStaticDependencyRootV2[];
+    equivalence_cases: DesignResourceSymbolicNoninterferenceEquivalenceCaseV2[];
+    complete_domain_cardinality: string | null;
+    exhaustive_evaluation_sha256: string | null;
+}
+export interface DesignResourceSymbolicNoninterferenceArtifactV2 {
+    schema_version: "design-resource-symbolic-noninterference-artifact-v2";
+    side: "source" | "production";
+    method: DesignResourceSymbolicNoninterferenceProofMethodV2;
+    oracle_identity: string;
+    oracle_version: string;
+    oracle_implementation_sha256: string;
+    oracle_capability: string;
+    environment_sha256: string;
+    input_resources: DesignResourceSymbolicNoninterferenceInputBindingV2[];
+    input_snapshot_sha256: string;
+    source_manifest_snapshot_sha256: string | null;
+    target_snapshot_sha256: string;
+    certificate_scope_sha256: string;
+    rule_scope_sha256: string;
+    omitted_axis_refs: string[];
+    derived_result: DesignResourceSymbolicNoninterferenceDerivedResultV2;
+    method_result_sha256: string;
+    verdict: "passed" | "failed";
+    failure_witness: DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;
+}
+export interface DesignResourceSymbolicNoninterferenceProofV2 {
+    side: "source" | "production";
+    method: DesignResourceSymbolicNoninterferenceProofMethodV2;
+    input_resource_refs: string[];
+    oracle_ref: string;
+    environment_ref: string;
+    static_dependency_nodes: DesignResourceSymbolicStaticDependencyNodeV2[];
+    static_rule_roots: DesignResourceSymbolicStaticDependencyRootV2[];
+    equivalence_cases: DesignResourceSymbolicNoninterferenceEquivalenceCaseV2[];
+    dynamic_dependency_kinds: string[];
+    external_device_refs: string[];
+    complete_domain_cardinality: string | null;
+    oracle_version: string;
+    oracle_implementation_sha256: string;
+    oracle_capability: string;
+    environment_sha256: string;
+    input_snapshot_sha256: string;
+    source_manifest_snapshot_sha256: string | null;
+    target_snapshot_sha256: string;
+    certificate_scope_sha256: string;
+    rule_scope_sha256: string;
+    omitted_axis_refs: string[];
+    method_result_sha256: string;
+    artifact_resource_ref: string;
+    artifact_path: string;
+    artifact_sha256: string;
+    failure_witness: DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;
+}

package/dist/lib/design-resource-symbolic-noninterference-types.js

@@ -0,0 +1 @@
+export {};

package/dist/lib/design-resource-symbolic-noninterference-validation.d.ts

@@ -0,0 +1,5 @@
+import type { DesignResourceSymbolicCompilationSession } from "./design-resource-symbolic-compilation.js";
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceHandoffPreflightV2, DesignResourceObservableRuleManifestV2, DesignResourceSymbolicNoninterferenceCertificateV2 } from "./design-resource-symbolic-fact-types.js";
+import type { SymbolicManifestIndexes } from "./design-resource-symbolic-indexes.js";
+export declare function validateTrustedSymbolicNoninterference(manifest: DesignResourceObservableRuleManifestV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, projections: DesignResourceHandoffPreflightV2["rule_projections"], indexes: SymbolicManifestIndexes, compilation: DesignResourceSymbolicCompilationSession, target: DesignResourceHandoffPreflightV2["handoff"]["targets"][number], resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>): void;

package/dist/lib/design-resource-symbolic-noninterference-validation.js

@@ -0,0 +1,62 @@
+import { DESIGN_RESOURCE_SYMBOLIC_NONINTERFERENCE_ORACLE_CAPABILITIES, } from "./design-resource-fact-enums.js";
+import { validateSymbolicNoninterferenceEquivalence } from "./design-resource-symbolic-noninterference-equivalence.js";
+import { validateStaticDependencyClosure } from "./design-resource-symbolic-static-dependency-validation.js";
+import { validateSymbolicNoninterferenceArtifact } from "./design-resource-symbolic-noninterference-artifact.js";
+import { assertSameSet, invalid, unique, } from "./design-resource-symbolic-validation-support.js";
+export function validateTrustedSymbolicNoninterference(manifest, certificate, projections, indexes, compilation, target, resources, contents) {
+    if (!certificate.omitted_axis_refs.length) {
+        if (certificate.source_noninterference_proof != null ||
+            certificate.production_noninterference_proof != null)
+            invalid("v2_noninterference_proof_without_omission", certificate.key);
+        return;
+    }
+    const proofs = [
+        ["source", certificate.source_noninterference_proof],
+        ["production", certificate.production_noninterference_proof],
+    ];
+    for (const [side, proof] of proofs) {
+        if (!proof)
+            invalid("v2_noninterference_proof_unavailable", `${certificate.key}:${side}:${certificate.omitted_axis_refs.join(",")}`);
+        validateProof(side, proof, manifest, certificate, projections, indexes, compilation, target, resources, contents);
+    }
+}
+function validateProof(expectedSide, proof, manifest, certificate, projections, indexes, compilation, target, resources, contents) {
+    if (proof.side !== expectedSide)
+        invalid("v2_noninterference_proof_side_mismatch", `${certificate.key}:${expectedSide}:${proof.side}`);
+    assertSameSet(proof.input_resource_refs, manifest.inspector.input_resources.map((item) => item.resource_ref), "v2_noninterference_input_closure_mismatch", `${certificate.key}:${expectedSide}`);
+    if (!indexes.oracles.has(proof.oracle_ref))
+        invalid("v2_noninterference_oracle_unknown", proof.oracle_ref);
+    const oracle = indexes.oracles.get(proof.oracle_ref);
+    if (oracle.trust !== "frozen_executable" || oracle.sha256 === null)
+        invalid("v2_noninterference_frozen_oracle_required", proof.oracle_ref);
+    const requiredCapability = `symbolic_noninterference.${expectedSide}.${proof.method}`;
+    if (!isNoninterferenceOracleCapability(requiredCapability))
+        invalid("v2_noninterference_oracle_capability_unregistered", requiredCapability);
+    if (!oracle.capability_refs.includes(requiredCapability))
+        invalid("v2_noninterference_oracle_capability_missing", `${proof.oracle_ref}:${requiredCapability}`);
+    if (proof.oracle_capability !== requiredCapability)
+        invalid("v2_noninterference_oracle_capability_binding_mismatch", `${certificate.key}:${proof.oracle_capability}:${requiredCapability}`);
+    if (!indexes.environments.has(proof.environment_ref))
+        invalid("v2_noninterference_environment_unknown", proof.environment_ref);
+    if (proof.dynamic_dependency_kinds.length)
+        invalid("v2_noninterference_dynamic_dependency_unproved", `${certificate.key}:${proof.dynamic_dependency_kinds.join(",")}`);
+    if (proof.external_device_refs.length)
+        invalid("v2_noninterference_external_device_unproved", `${certificate.key}:${proof.external_device_refs.join(",")}`);
+    unique(proof.input_resource_refs, `v2_noninterference_input_duplicate:${certificate.key}:${expectedSide}`);
+    unique(proof.dynamic_dependency_kinds, `v2_noninterference_dynamic_dependency_duplicate:${certificate.key}:${expectedSide}`);
+    unique(proof.external_device_refs, `v2_noninterference_external_device_duplicate:${certificate.key}:${expectedSide}`);
+    assertSameSet(proof.omitted_axis_refs, certificate.omitted_axis_refs, "v2_noninterference_artifact_omitted_axis_mismatch", `${certificate.key}:${expectedSide}`);
+    if (expectedSide === "source") {
+        validateSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents);
+        return;
+    }
+    if (proof.method === "closed_world_static_dependency_closure") {
+        validateStaticDependencyClosure(proof, certificate, projections, manifest);
+    }
+    else
+        validateSymbolicNoninterferenceEquivalence(proof, manifest, certificate, projections, compilation);
+    validateSymbolicNoninterferenceArtifact(manifest, certificate, proof, target, resources, contents);
+}
+function isNoninterferenceOracleCapability(value) {
+    return DESIGN_RESOURCE_SYMBOLIC_NONINTERFERENCE_ORACLE_CAPABILITIES.includes(value);
+}

package/dist/lib/design-resource-symbolic-oracle-fingerprint.d.ts

@@ -0,0 +1 @@
+export declare function fingerprintExecutableModuleClosure(entryUrls: readonly string[]): string;

package/dist/lib/design-resource-symbolic-oracle-fingerprint.js

@@ -0,0 +1,47 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const LOCAL_MODULE_IMPORT = /(?:\bfrom\s*|\bimport\s*)["'](\.[^"']+\.js)["']/gu;
+const DYNAMIC_MODULE_IMPORT = /\bimport\s*\(/gu;
+const HIDDEN_LOCAL_LOADER = /\b(?:createRequire|require)\s*\(/gu;
+export function fingerprintExecutableModuleClosure(entryUrls) {
+    const pending = [...new Set(entryUrls)].sort();
+    const seen = new Map();
+    while (pending.length) {
+        const url = pending.shift();
+        if (seen.has(url))
+            continue;
+        const bytes = readFileSync(fileURLToPath(url));
+        const source = bytes.toString("utf8");
+        if (DYNAMIC_MODULE_IMPORT.test(source))
+            throw new Error(`symbolic Oracle implementation uses dynamic import: ${url}`);
+        DYNAMIC_MODULE_IMPORT.lastIndex = 0;
+        if (HIDDEN_LOCAL_LOADER.test(source))
+            throw new Error(`symbolic Oracle implementation uses a hidden local loader: ${url}`);
+        HIDDEN_LOCAL_LOADER.lastIndex = 0;
+        seen.set(url, bytes);
+        for (const specifier of localModuleImports(source)) {
+            const dependencyUrl = new URL(specifier, url).href;
+            if (!seen.has(dependencyUrl))
+                pending.push(dependencyUrl);
+        }
+        pending.sort();
+    }
+    const commonRoot = path.dirname(fileURLToPath([...seen.keys()].sort()[0] ?? entryUrls[0]));
+    const entries = [...seen.entries()]
+        .map(([url, bytes]) => ({
+        path: path
+            .relative(commonRoot, fileURLToPath(url))
+            .replaceAll(path.sep, "/"),
+        sha256: createHash("sha256").update(bytes).digest("hex"),
+    }))
+        .sort((left, right) => left.path.localeCompare(right.path, "en"));
+    return createHash("sha256").update(JSON.stringify(entries)).digest("hex");
+}
+function localModuleImports(source) {
+    const result = [];
+    for (const match of source.matchAll(LOCAL_MODULE_IMPORT))
+        result.push(match[1]);
+    return result;
+}

package/dist/lib/design-resource-symbolic-predicate-shape.d.ts

@@ -0,0 +1,6 @@
+import type { SymbolicDenotationAxisDomain, SymbolicDenotationPredicate } from "./symbolic-denotation-types.js";
+export declare function parseSymbolicAxisDomains(value: unknown, label: string): SymbolicDenotationAxisDomain[];
+export declare function parseSymbolicPredicate(value: unknown, label: string): SymbolicDenotationPredicate;
+export declare function parseSymbolicScalar(value: unknown, label: string): string | number;
+export declare function parseSymbolicSafeInteger(value: unknown, label: string): number;
+export declare function parseSymbolicNonnegativeInteger(value: unknown, label: string): number;

package/dist/lib/design-resource-symbolic-predicate-shape.js

@@ -0,0 +1,123 @@
+import { stableKey, stableKeys, } from "./design-resource-handoff-shape-primitives.js";
+import { array, boolean, literal, object, } from "./long-task-shape-primitives.js";
+export function parseSymbolicAxisDomains(value, label) {
+    return array(value, label).map((item, index) => {
+        const itemLabel = `${label}[${index}]`;
+        const kindValue = object(item, itemLabel, ["key", "kind"], ["values", "minimum", "maximum", "integer"]).kind;
+        if (kindValue === "enum") {
+            const row = object(item, itemLabel, ["key", "kind", "values"]);
+            return {
+                key: stableKey(row.key, `${itemLabel}.key`),
+                kind: literal(row.kind, ["enum"], `${itemLabel}.kind`),
+                values: stableKeys(row.values, `${itemLabel}.values`),
+            };
+        }
+        const row = object(item, itemLabel, [
+            "key",
+            "kind",
+            "minimum",
+            "maximum",
+            "integer",
+        ]);
+        return {
+            key: stableKey(row.key, `${itemLabel}.key`),
+            kind: literal(row.kind, ["bounded_number"], `${itemLabel}.kind`),
+            minimum: parseSymbolicSafeInteger(row.minimum, `${itemLabel}.minimum`),
+            maximum: parseSymbolicSafeInteger(row.maximum, `${itemLabel}.maximum`),
+            integer: parseLiteralBooleanTrue(row.integer, `${itemLabel}.integer`),
+        };
+    });
+}
+export function parseSymbolicPredicate(value, label) {
+    const operator = object(value, label, ["op"], [
+        "axis_ref",
+        "value",
+        "values",
+        "minimum",
+        "maximum",
+        "minimum_inclusive",
+        "maximum_inclusive",
+        "predicates",
+        "predicate",
+    ]).op;
+    if (operator === "eq")
+        return parseEquality(value, label);
+    if (operator === "in")
+        return parseMembership(value, label);
+    if (operator === "range")
+        return parseRange(value, label);
+    if (operator === "all" || operator === "any")
+        return parseGroup(value, label);
+    if (operator === "not")
+        return parseNegation(value, label);
+    throw new Error(`design_resource_symbolic_manifest_invalid:${label}.op:unknown:${String(operator)}`);
+}
+function parseEquality(value, label) {
+    const row = object(value, label, ["op", "axis_ref", "value"]);
+    return {
+        op: "eq",
+        axis_ref: stableKey(row.axis_ref, `${label}.axis_ref`),
+        value: parseSymbolicScalar(row.value, `${label}.value`),
+    };
+}
+function parseMembership(value, label) {
+    const row = object(value, label, ["op", "axis_ref", "values"]);
+    return {
+        op: "in",
+        axis_ref: stableKey(row.axis_ref, `${label}.axis_ref`),
+        values: array(row.values, `${label}.values`).map((entry, index) => parseSymbolicScalar(entry, `${label}.values[${index}]`)),
+    };
+}
+function parseRange(value, label) {
+    const row = object(value, label, [
+        "op",
+        "axis_ref",
+        "minimum",
+        "maximum",
+        "minimum_inclusive",
+        "maximum_inclusive",
+    ]);
+    return {
+        op: "range",
+        axis_ref: stableKey(row.axis_ref, `${label}.axis_ref`),
+        minimum: parseSymbolicSafeInteger(row.minimum, `${label}.minimum`),
+        maximum: parseSymbolicSafeInteger(row.maximum, `${label}.maximum`),
+        minimum_inclusive: boolean(row.minimum_inclusive, `${label}.minimum_inclusive`),
+        maximum_inclusive: boolean(row.maximum_inclusive, `${label}.maximum_inclusive`),
+    };
+}
+function parseGroup(value, label) {
+    const row = object(value, label, ["op", "predicates"]);
+    return {
+        op: literal(row.op, ["all", "any"], `${label}.op`),
+        predicates: array(row.predicates, `${label}.predicates`).map((entry, index) => parseSymbolicPredicate(entry, `${label}.predicates[${index}]`)),
+    };
+}
+function parseNegation(value, label) {
+    const row = object(value, label, ["op", "predicate"]);
+    return {
+        op: "not",
+        predicate: parseSymbolicPredicate(row.predicate, `${label}.predicate`),
+    };
+}
+export function parseSymbolicScalar(value, label) {
+    if (typeof value === "string")
+        return stableKey(value, label);
+    return parseSymbolicSafeInteger(value, label);
+}
+export function parseSymbolicSafeInteger(value, label) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value))
+        throw new Error(`design_resource_symbolic_manifest_invalid:${label}:safe_integer_required`);
+    return value;
+}
+export function parseSymbolicNonnegativeInteger(value, label) {
+    const parsed = parseSymbolicSafeInteger(value, label);
+    if (parsed < 0)
+        throw new Error(`design_resource_symbolic_manifest_invalid:${label}:nonnegative_required`);
+    return parsed;
+}
+function parseLiteralBooleanTrue(value, label) {
+    if (boolean(value, label) !== true)
+        throw new Error(`design_resource_symbolic_manifest_invalid:${label}:must_be_true`);
+    return true;
+}

package/dist/lib/design-resource-symbolic-production-closure.d.ts

@@ -0,0 +1,4 @@
+import { Buffer } from "node:buffer";
+import type { DesignResource } from "./design-resource-handoff-file-primitives.js";
+import type { DesignResourceSymbolicHandoffTargetV2, DesignResourceSymbolicNoninterferenceCertificateV2, DesignResourceSymbolicNoninterferenceFailureWitnessV1 } from "./design-resource-symbolic-fact-types.js";
+export declare function productionClosureFailure(target: DesignResourceSymbolicHandoffTargetV2, certificate: DesignResourceSymbolicNoninterferenceCertificateV2, resources: ReadonlyMap<string, DesignResource>, contents: ReadonlyMap<string, Buffer>): DesignResourceSymbolicNoninterferenceFailureWitnessV1 | null;

package/dist/lib/design-resource-symbolic-production-closure.js

@@ -0,0 +1,144 @@
+import { Buffer } from "node:buffer";
+import { symbolicNoninterferenceCertificateScopeSha256 } from "./design-resource-symbolic-noninterference-scope.js";
+import { DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE } from "./design-resource-symbolic-source-ir-types.js";
+import { canonicalJson } from "./strict-codec.js";
+const SAFE_STATIC_HTML_TAGS = new Set([
+    "article",
+    "aside",
+    "body",
+    "br",
+    "div",
+    "footer",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "head",
+    "header",
+    "html",
+    "li",
+    "main",
+    "nav",
+    "ol",
+    "p",
+    "section",
+    "span",
+    "strong",
+    "ul",
+]);
+const SAFE_STATIC_HTML_ATTRIBUTE = /^(?:aria-[a-z0-9-]+|class|data-[a-z0-9-]+|dir|id|lang|role|title)$/u;
+const HTML_TOKEN = /<!doctype\s+html\s*>|<\/?[A-Za-z][A-Za-z0-9]*\b[^<>]*>/giu;
+const HTML_TAG = /^<(\/)?([A-Za-z][A-Za-z0-9]*)([^<>]*)>$/u;
+const HTML_ATTRIBUTE = /\s+([A-Za-z_:][A-Za-z0-9_.:-]*)(?:\s*=\s*(?:"[^"]*"|'[^']*'))?/guy;
+export function productionClosureFailure(target, certificate, resources, contents) {
+    for (const resourceRef of target.resource_refs) {
+        const resource = resources.get(resourceRef);
+        const bytes = contents.get(resourceRef);
+        if (!resource || !bytes)
+            continue;
+        if (resourceRef === target.source_profile.entry_resource_ref) {
+            if (resource.media_type !== "text/html")
+                return witness(certificate, resource, null, `unsupported_entry_media:${resource.media_type}`);
+            const failure = staticHtmlFailure(bytes.toString("utf8"));
+            if (failure)
+                return witness(certificate, resource, failure.offset, failure.detail, bytes.toString("utf8"));
+            continue;
+        }
+        if (resource.media_type !== "application/json" &&
+            resource.media_type !== DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE)
+            return witness(certificate, resource, null, `unsupported_dependency_media:${resource.media_type}`);
+        try {
+            const parsed = JSON.parse(bytes.toString("utf8"));
+            if (resource.media_type === DESIGN_RESOURCE_SYMBOLIC_SOURCE_IR_MEDIA_TYPE &&
+                canonicalJson(parsed) !== bytes.toString("utf8"))
+                return witness(certificate, resource, null, "noncanonical_symbolic_source_ir");
+        }
+        catch {
+            return witness(certificate, resource, null, "invalid_inert_json");
+        }
+    }
+    return null;
+}
+function staticHtmlFailure(source) {
+    let cursor = 0;
+    let doctypeSeen = false;
+    for (const match of source.matchAll(HTML_TOKEN)) {
+        const token = match[0];
+        const offset = match.index;
+        if (source.slice(cursor, offset).includes("<"))
+            return {
+                offset: cursor + source.slice(cursor, offset).indexOf("<"),
+                detail: "unsupported_html_token",
+            };
+        cursor = offset + token.length;
+        if (/^<!doctype/iu.test(token)) {
+            if (doctypeSeen || source.slice(0, offset).trim())
+                return { offset, detail: "misplaced_or_duplicate_doctype" };
+            doctypeSeen = true;
+            continue;
+        }
+        const parsed = HTML_TAG.exec(token);
+        if (!parsed)
+            return { offset, detail: "unsupported_html_token" };
+        const closing = parsed[1] === "/";
+        const tag = parsed[2].toLowerCase();
+        if (!SAFE_STATIC_HTML_TAGS.has(tag))
+            return { offset, detail: `unsupported_html_tag:${tag}` };
+        const attributes = parsed[3];
+        if (closing) {
+            if (attributes.trim())
+                return { offset, detail: "closing_tag_attributes" };
+            continue;
+        }
+        const attributeFailure = staticAttributeFailure(attributes);
+        if (attributeFailure)
+            return {
+                offset: offset + token.indexOf(attributes) + attributeFailure.offset,
+                detail: attributeFailure.detail,
+            };
+    }
+    const remainder = source.slice(cursor);
+    if (remainder.includes("<"))
+        return {
+            offset: cursor + remainder.indexOf("<"),
+            detail: "unsupported_html_token",
+        };
+    return null;
+}
+function staticAttributeFailure(source) {
+    const value = source.endsWith("/") ? source.slice(0, -1) : source;
+    let cursor = 0;
+    HTML_ATTRIBUTE.lastIndex = 0;
+    while (cursor < value.length) {
+        HTML_ATTRIBUTE.lastIndex = cursor;
+        const match = HTML_ATTRIBUTE.exec(value);
+        if (!match || match.index !== cursor)
+            return { offset: cursor, detail: "unsupported_html_attribute_syntax" };
+        const name = match[1].toLowerCase();
+        if (!SAFE_STATIC_HTML_ATTRIBUTE.test(name))
+            return { offset: cursor, detail: `unsupported_html_attribute:${name}` };
+        cursor = HTML_ATTRIBUTE.lastIndex;
+    }
+    return null;
+}
+function witness(certificate, resource, byteOffset, detail, source = "") {
+    const axisRef = certificate.omitted_axis_refs.find((axis) => source.includes(axis));
+    return {
+        kind: axisRef ? "omitted_axis_dependency" : "unsupported_dependency",
+        side: "production",
+        certificate_scope_sha256: symbolicNoninterferenceCertificateScopeSha256(certificate),
+        axis_ref: axisRef ?? null,
+        fact_rule_ref: null,
+        resource_ref: resource.key,
+        path: resource.path,
+        locator: null,
+        node_ref: null,
+        byte_offset: byteOffset === null
+            ? null
+            : Buffer.byteLength(source.slice(0, byteOffset)),
+        assignment: null,
+        detail,
+    };
+}