project-tiny-context-harness 0.8.17 → 0.11.0

package/dist/lib/long-task-external-confirmation-expected.js

@@ -0,0 +1,200 @@
+import { admittedObjectiveExternalComparator, objectiveExternalClaimActualAuthority, objectivePopulationSet, } from "./long-task-acceptance-reachability-helpers.js";
+import { controlFieldFacts } from "./long-task-control-fields.js";
+import { DESIGN_RESOURCE_COMPARATORS } from "./design-resource-fact-enums.js";
+import { findDesignFactObligation } from "./long-task-design-obligation.js";
+import { evaluateExactDigestComparison } from "./long-task-exact-comparison.js";
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+export function expectedForExternalObligation(compiled, manifest, row, authorityRef) {
+    if (row.fact_ref && row.proof_ref) {
+        const fact = manifest.facts.find((candidate) => candidate.key === row.fact_ref);
+        const proof = manifest.proof_obligations.find((candidate) => candidate.key === row.proof_ref);
+        if (fact && proof)
+            return {
+                authority_ref: authorityRef,
+                kind: "semantic_fact",
+                statement: null,
+                located_value: fact.expected,
+                comparison: proof.comparison,
+            };
+        const design = findDesignFactObligation(compiled, row);
+        if (design)
+            return {
+                authority_ref: authorityRef,
+                kind: "design_fact",
+                statement: null,
+                located_value: design.expected,
+                comparison: {
+                    comparator: "strict_digest_equal",
+                    mode: "exact",
+                    parameters: {
+                        kind: "design_strict_comparison",
+                        ref: row.proof_ref,
+                        sha256: sha256Hex(canonicalValueJson(design.comparison)),
+                    },
+                    tolerance: null,
+                    mask: null,
+                },
+            };
+        throw new Error(`external_confirmation_expected_fact_missing:${row.obligation_ref}`);
+    }
+    const statement = contractClaimStatement(compiled, row.claim_ref);
+    if (statement === null)
+        throw new Error(`external_confirmation_expected_claim_unresolved:${row.claim_ref}`);
+    const claimActual = objectiveExternalClaimActualAuthority(compiledChecks(compiled), row);
+    if (claimActual) {
+        if (!Object.hasOwn(claimActual, "expected_value") ||
+            sha256Hex(canonicalValueJson(claimActual.expected_value)) !==
+                claimActual.expected_value_sha256)
+            throw new Error(`external_confirmation_expected_claim_actual_invalid:${row.obligation_ref}`);
+        return {
+            authority_ref: authorityRef,
+            kind: "contract_claim_actual",
+            statement,
+            located_value: {
+                kind: "compiled_assertion",
+                ref: claimActual.assertion_ref,
+                sha256: claimActual.expected_value_sha256,
+                value: claimActual.expected_value,
+            },
+            comparison: {
+                comparator: claimActual.comparison.comparator,
+                mode: "exact",
+                parameters: {
+                    kind: "compiled_assertion_comparison",
+                    ref: claimActual.expected_identity,
+                    sha256: claimActual.comparison.parameters_sha256,
+                },
+                tolerance: null,
+                mask: null,
+            },
+        };
+    }
+    return {
+        authority_ref: authorityRef,
+        kind: "contract_claim",
+        statement,
+        located_value: null,
+        comparison: null,
+    };
+}
+export function objectiveExternalComparison(compiled, manifest, row, actual) {
+    if (!row.fact_ref && !row.proof_ref) {
+        const authority = objectiveExternalClaimActualAuthority(compiledChecks(compiled), row);
+        if (!authority || authority.comparison.parameters_sha256 === null)
+            return null;
+        const projectedActual = authority.actual_projection === "raw_exact"
+            ? actual
+            : authority.actual_projection === "presence_boolean"
+                ? true
+                : Boolean(actual);
+        return evaluateExactDigestComparison({
+            identity: {
+                confirmation_ref: row.confirmation_ref,
+                obligation_ref: row.source_obligation_ref,
+                fact_ref: null,
+                proof_ref: null,
+                applicability_ref: row.applicability_ref,
+            },
+            actual_value_sha256: sha256Hex(canonicalValueJson(projectedActual)),
+            expected_value_sha256: authority.expected_value_sha256,
+            comparator: authority.comparison.comparator,
+            mode: "exact",
+            parameters_sha256: authority.comparison.parameters_sha256,
+            tolerance_sha256: null,
+            mask_sha256: null,
+        });
+    }
+    if (!row.fact_ref || !row.proof_ref)
+        return null;
+    const fact = manifest.facts.find((candidate) => candidate.key === row.fact_ref);
+    const proof = manifest.proof_obligations.find((candidate) => candidate.key === row.proof_ref);
+    if (fact && proof && proof.fact_ref === fact.key) {
+        const comparator = admittedObjectiveExternalComparator(manifest, row.fact_ref, row.proof_ref);
+        if (!comparator)
+            return null;
+        if (comparator === "population_set_equal") {
+            const expected = fact.expected.value;
+            if (!objectivePopulationSet(expected))
+                return null;
+            const actualSet = objectivePopulationSet(actual) ? new Set(actual) : null;
+            return {
+                passed: Boolean(actualSet &&
+                    actualSet.size === expected.length &&
+                    expected.every((item) => actualSet.has(item))),
+            };
+        }
+        return evaluateExactDigestComparison({
+            identity: {
+                confirmation_ref: row.confirmation_ref,
+                obligation_ref: row.obligation_ref,
+                fact_ref: row.fact_ref,
+                proof_ref: row.proof_ref,
+                applicability_ref: row.applicability_ref,
+            },
+            actual_value_sha256: sha256Hex(canonicalValueJson(actual)),
+            expected_value_sha256: fact.expected.sha256,
+            comparator: proof.comparison.comparator,
+            mode: proof.comparison.mode,
+            parameters_sha256: proof.comparison.parameters.sha256,
+            tolerance_sha256: null,
+            mask_sha256: null,
+        });
+    }
+    const design = findDesignFactObligation(compiled, row);
+    if (!design ||
+        design.observation_sensitivity !== "plain" ||
+        !DESIGN_RESOURCE_COMPARATORS.includes(design.comparison
+            .comparator))
+        return null;
+    return {
+        passed: sha256Hex(canonicalValueJson(actual)) === design.expected.sha256,
+    };
+}
+function compiledChecks(compiled) {
+    return [
+        ...compiled.global.acceptance.checks,
+        ...compiled.outcomes.flatMap((outcome) => outcome.acceptance.checks),
+    ];
+}
+function contractClaimStatement(compiled, claimRef) {
+    if (claimRef.startsWith("GLOBAL."))
+        return globalClaimStatement(compiled, claimRef.slice("GLOBAL.".length));
+    const outcome = compiled.outcomes.find((candidate) => claimRef === candidate.key || claimRef.startsWith(`${candidate.key}.`));
+    if (!outcome)
+        return null;
+    const local = claimRef.slice(outcome.key.length + 1);
+    if (local === "result")
+        return outcome.product.observable_result;
+    if (local === "control_relation_closure")
+        return outcome.product.control_relation_closure.statement;
+    const [kind, key, ...suffix] = local.split(".");
+    const statements = {
+        requirement: outcome.product.requirements,
+        obligation: outcome.technical.obligations,
+        non_completing: outcome.product.non_completing_outcomes,
+        forbidden_shortcut: outcome.technical.forbidden_shortcuts,
+        control_relation: outcome.product.control_relations,
+    };
+    if (kind in statements)
+        return (statements[kind].find((row) => row.key === key)
+            ?.statement ?? null);
+    if (kind !== "control")
+        return null;
+    const control = outcome.product.controls.find((row) => row.key === key);
+    if (!control)
+        return null;
+    return (controlFieldFacts(control).find((row) => row.claim_field === suffix.join("."))?.statement ?? null);
+}
+function globalClaimStatement(compiled, local) {
+    const [kind, ...rest] = local.split(".");
+    const key = rest.join(".");
+    if (kind === "non_goal")
+        return (compiled.global.product.non_goals.find((row) => row.key === key)
+            ?.statement ?? null);
+    if (kind === "constraint")
+        return (compiled.global.technical.constraints.find((row) => row.key === key)
+            ?.statement ?? null);
+    if (kind === "forbidden_shortcut")
+        return (compiled.global.technical.forbidden_shortcuts.find((row) => row.key === key)?.statement ?? null);
+    return null;
+}

package/dist/lib/long-task-external-confirmation-identity.d.ts

@@ -0,0 +1,10 @@
+import type { EffectiveExternalObligationV1 } from "./long-task-acceptance-reachability-types.js";
+import type { CompiledDeliveryContractV2, ExternalConfirmationV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
+import type { RelevantExternalInputIdentityV1 } from "./long-task-external-confirmation-types.js";
+export declare function deriveRelevantExternalInputIdentity(compiled: CompiledDeliveryContractV2, confirmationRef: string, manifest: WorkspaceManifestV2): RelevantExternalInputIdentityV1;
+export declare function allEffectiveExternalRows(compiled: CompiledDeliveryContractV2, confirmationRef: string): EffectiveExternalObligationV1[];
+export declare function blockingExternalRows(compiled: CompiledDeliveryContractV2, confirmationRef: string): EffectiveExternalObligationV1[];
+export declare function advisoryExternalRows(compiled: CompiledDeliveryContractV2, confirmationRef: string): EffectiveExternalObligationV1[];
+export declare function requiredConfirmation(compiled: CompiledDeliveryContractV2, confirmationRef: string): ExternalConfirmationV2;
+export declare function sameSet(left: readonly string[], right: readonly string[]): boolean;
+export declare function sameValue(left: unknown, right: unknown): boolean;

package/dist/lib/long-task-external-confirmation-identity.js

@@ -0,0 +1,77 @@
+import { matchesRepoPattern } from "./long-task-paths.js";
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+export function deriveRelevantExternalInputIdentity(compiled, confirmationRef, manifest) {
+    const confirmation = requiredConfirmation(compiled, confirmationRef);
+    if (blockingExternalRows(compiled, confirmationRef).length)
+        return wholeCandidateIdentity(manifest);
+    const rows = allEffectiveExternalRows(compiled, confirmationRef);
+    const outcomeKeys = [...new Set(rows.map((row) => row.outcome_key))];
+    if (!rows.length || outcomeKeys.some((key) => key === null))
+        return wholeCandidateIdentity(manifest);
+    const outcomes = outcomeKeys.map((key) => compiled.outcomes.find((outcome) => outcome.key === key));
+    if (outcomes.some((outcome) => !outcome ||
+        !outcome.product.owner.path_globs.length ||
+        !outcome.technical.bindings.length ||
+        outcome.technical.bindings.some((binding) => !binding.carrier_paths.length)))
+        return wholeCandidateIdentity(manifest);
+    const patterns = [
+        ...new Set(outcomes.flatMap((outcome) => [
+            ...outcome.product.owner.path_globs,
+            ...outcome.technical.expected_change_paths,
+            ...outcome.technical.allowed_support_paths,
+            ...outcome.technical.bindings.flatMap((binding) => [
+                ...(binding.kind === "file" || binding.kind === "path_glob"
+                    ? [binding.target]
+                    : []),
+                ...binding.carrier_paths,
+            ]),
+        ])),
+    ].sort();
+    if (!patterns.length)
+        return wholeCandidateIdentity(manifest);
+    const files = manifest.files
+        .filter((file) => patterns.some((pattern) => matchesRepoPattern(file.path, pattern)))
+        .map((file) => ({
+        path: file.path,
+        mode: file.mode,
+        size: file.size,
+        sha256: file.sha256,
+    }))
+        .sort((left, right) => left.path.localeCompare(right.path));
+    const digest = sha256Hex(canonicalValueJson({ mode: "bounded_paths", patterns, files }));
+    return {
+        mode: "bounded_paths",
+        identity: `bounded:${digest}`,
+        paths: files.map((file) => file.path),
+    };
+}
+export function allEffectiveExternalRows(compiled, confirmationRef) {
+    return (compiled.acceptance_reachability.effective_external_routes ?? []).filter((row) => row.confirmation_ref === confirmationRef);
+}
+export function blockingExternalRows(compiled, confirmationRef) {
+    return allEffectiveExternalRows(compiled, confirmationRef).filter((row) => row.completion_role === "blocking");
+}
+export function advisoryExternalRows(compiled, confirmationRef) {
+    return allEffectiveExternalRows(compiled, confirmationRef).filter((row) => row.completion_role === "advisory");
+}
+export function requiredConfirmation(compiled, confirmationRef) {
+    const confirmation = compiled.global.acceptance.external_confirmations.find((candidate) => candidate.key === confirmationRef);
+    if (!confirmation)
+        throw new Error(`external_confirmation_unknown:${confirmationRef}`);
+    return confirmation;
+}
+export function sameSet(left, right) {
+    return (left.length === right.length &&
+        new Set(left).size === left.length &&
+        left.every((item) => right.includes(item)));
+}
+export function sameValue(left, right) {
+    return canonicalValueJson(left) === canonicalValueJson(right);
+}
+function wholeCandidateIdentity(manifest) {
+    return {
+        mode: "whole_candidate",
+        identity: `whole:${manifest.snapshot_sha256}`,
+        paths: manifest.files.map((file) => file.path).sort(),
+    };
+}

package/dist/lib/long-task-external-confirmation-plan.d.ts

@@ -0,0 +1,25 @@
+import type { CompiledDeliveryContractV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
+import { externalConfirmationRecordHash, externalConfirmationRecordV2Hash } from "./long-task-external-confirmation-shape.js";
+import type { ExternalConfirmationCandidateV1, ExternalConfirmationEvaluationV1, ExternalConfirmationPreparationV1 } from "./long-task-external-confirmation-types.js";
+import type { SemanticFactManifestV1 } from "./semantic-fact-types.js";
+export { deriveRelevantExternalInputIdentity } from "./long-task-external-confirmation-identity.js";
+export declare function prepareExternalConfirmations(workdirInput: string, confirmationRef?: string): Promise<ExternalConfirmationPreparationV1>;
+export declare function submitExternalConfirmation(input: {
+    workdir: string;
+    confirmation_ref: string;
+    record_path: string;
+}): Promise<ExternalConfirmationEvaluationV1>;
+export declare function externalConfirmationStatus(workdirInput: string): Promise<Record<string, unknown>>;
+export declare function revokeExternalConfirmation(input: {
+    workdir: string;
+    confirmation_ref: string;
+}): Promise<Record<string, unknown>>;
+export declare function rotateExternalConfirmation(input: {
+    workdir: string;
+    confirmation_ref: string;
+}): Promise<Record<string, unknown>>;
+export declare function evaluateExternalConfirmations(compiled: CompiledDeliveryContractV2, repository: string, workdir: string, manifest: WorkspaceManifestV2, candidate: ExternalConfirmationCandidateV1, semanticManifestInput?: SemanticFactManifestV1): Promise<ExternalConfirmationEvaluationV1[]>;
+export declare const externalConfirmationRecordIntegrity: {
+    hash_v1: typeof externalConfirmationRecordHash;
+    hash_v2: typeof externalConfirmationRecordV2Hash;
+};

package/dist/lib/long-task-external-confirmation-plan.js

@@ -0,0 +1,148 @@
+import { loadExternalAuthorityContext, readSubmittedExternalConfirmationRecord, } from "./long-task-external-confirmation-context.js";
+import { captureAndStoreExternalConfirmationArtifacts, MAX_TOTAL_EXTERNAL_CONFIRMATION_ARTIFACT_BYTES, } from "./long-task-external-confirmation-artifacts.js";
+import { rotateExternalConfirmationChallenge, } from "./long-task-external-confirmation-challenge.js";
+import { emptyExternalConfirmationEvaluation, evaluateExternalConfirmationRecord, externalConfirmationSubmissionEnvelopeIssues, partitionExternalConfirmationArtifactSnapshots, } from "./long-task-external-confirmation-evaluation.js";
+import { allEffectiveExternalRows, requiredConfirmation, } from "./long-task-external-confirmation-identity.js";
+import { externalFulfillableConfirmations, groupPreparationSessions, } from "./long-task-external-confirmation-preparation.js";
+import { externalConfirmationRecordHash, externalConfirmationRecordV2Hash, } from "./long-task-external-confirmation-shape.js";
+import { readStoredExternalConfirmationRecord, revokeStoredExternalConfirmationRecord, writeStoredExternalConfirmationRecord, } from "./long-task-external-confirmation-state.js";
+import { withActiveAuthorityLock } from "./long-task-state.js";
+import { repositoryRoot } from "./long-task-workspace.js";
+import { loadSemanticFactManifest } from "./semantic-fact-source-parser.js";
+export { deriveRelevantExternalInputIdentity } from "./long-task-external-confirmation-identity.js";
+export async function prepareExternalConfirmations(workdirInput, confirmationRef) {
+    const repository = await repositoryRoot(process.cwd());
+    return withActiveAuthorityLock(repository, "external_confirmation", async () => {
+        const context = await loadExternalAuthorityContext(workdirInput, true);
+        const confirmations = await externalFulfillableConfirmations(context, confirmationRef);
+        const sessions = groupPreparationSessions(confirmations, context.candidate);
+        return {
+            schema_version: "long-task-external-confirmation-preparation-v2",
+            acceptance_effect: "none",
+            notice: "Preparation output does not establish acceptance.",
+            task_id: context.compiled.task.id,
+            compiled_identity: context.compiled.compiled_identity,
+            authority_revision: context.compiled.authority_revision,
+            candidate: context.candidate,
+            actor_identity_boundary: "detached_ed25519_required_for_blocking_fulfillment",
+            confirmations,
+            sessions,
+            generated_at: new Date().toISOString(),
+        };
+    });
+}
+export async function submitExternalConfirmation(input) {
+    const repository = await repositoryRoot(process.cwd());
+    return withActiveAuthorityLock(repository, "external_confirmation", async () => {
+        const context = await loadExternalAuthorityContext(input.workdir, true);
+        const confirmation = requiredConfirmation(context.compiled, input.confirmation_ref);
+        const record = await readSubmittedExternalConfirmationRecord(input.record_path);
+        if (record.confirmation_ref !== input.confirmation_ref)
+            throw new Error(`external_confirmation_submit_ref_mismatch:${input.confirmation_ref}:${record.confirmation_ref}`);
+        if (record.schema_version !== "long-task-external-confirmation-record-v2")
+            throw new Error("external_confirmation_submit_rejected:legacy_unattested");
+        const envelopeIssues = await externalConfirmationSubmissionEnvelopeIssues(context, confirmation, record);
+        if (envelopeIssues.length)
+            throw new Error(`external_confirmation_submit_rejected:${envelopeIssues.join(",")}`);
+        const rows = allEffectiveExternalRows(context.compiled, confirmation.key);
+        const artifactPartitions = partitionExternalConfirmationArtifactSnapshots(rows, record);
+        await captureAndStoreExternalConfirmationArtifacts(context.repository, context.workdir, artifactPartitions.blocking_or_shared);
+        const blockingArtifactBytes = Object.values(artifactPartitions.blocking_or_shared).reduce((total, snapshot) => total + snapshot.size_bytes, 0);
+        if (Object.keys(artifactPartitions.advisory_only).length)
+            await captureAndStoreExternalConfirmationArtifacts(context.repository, context.workdir, artifactPartitions.advisory_only, {
+                max_total_bytes: Math.max(0, MAX_TOTAL_EXTERNAL_CONFIRMATION_ARTIFACT_BYTES -
+                    blockingArtifactBytes),
+            }).catch(() => {
+                // The role-scoped evaluation below records an absent or invalid
+                // advisory partition without contaminating a fulfilled blocking row.
+            });
+        const evaluation = await evaluateExternalConfirmationRecord(context, confirmation, record);
+        if (evaluation.state === "invalid" ||
+            evaluation.state === "stale" ||
+            evaluation.state === "legacy_unattested")
+            throw new Error(`external_confirmation_submit_rejected:${evaluation.state}:${evaluation.issues.join(",")}`);
+        await writeStoredExternalConfirmationRecord(context.repository, context.workdir, record);
+        return evaluation;
+    });
+}
+export async function externalConfirmationStatus(workdirInput) {
+    const context = await loadExternalAuthorityContext(workdirInput, false);
+    return {
+        schema_version: "long-task-external-confirmation-status-v2",
+        task_id: context.compiled.task.id,
+        compiled_identity: context.compiled.compiled_identity,
+        authority_revision: context.compiled.authority_revision,
+        candidate: context.candidate,
+        candidate_clean: context.candidate_dirty.length === 0,
+        candidate_dirty: context.candidate_dirty,
+        actor_identity_boundary: "detached_ed25519_required_for_blocking_fulfillment",
+        confirmations: await evaluateExternalConfirmations(context.compiled, context.repository, context.workdir, context.manifest, context.candidate, context.semantic_manifest),
+    };
+}
+export async function revokeExternalConfirmation(input) {
+    const repository = await repositoryRoot(process.cwd());
+    return withActiveAuthorityLock(repository, "external_confirmation", async () => {
+        const context = await loadExternalAuthorityContext(input.workdir, false);
+        requiredConfirmation(context.compiled, input.confirmation_ref);
+        const challenge = await rotateExternalConfirmationChallenge(context, input.confirmation_ref);
+        const revoked = await revokeStoredExternalConfirmationRecord(context.repository, context.workdir, input.confirmation_ref);
+        return {
+            schema_version: "long-task-external-confirmation-revoke-v2",
+            confirmation_ref: input.confirmation_ref,
+            status: revoked ? "revoked" : "not_present",
+            challenge_rotated: true,
+            challenge: challenge.challenge,
+        };
+    });
+}
+export async function rotateExternalConfirmation(input) {
+    const repository = await repositoryRoot(process.cwd());
+    return withActiveAuthorityLock(repository, "external_confirmation", async () => {
+        const context = await loadExternalAuthorityContext(input.workdir, false);
+        requiredConfirmation(context.compiled, input.confirmation_ref);
+        const challenge = await rotateExternalConfirmationChallenge(context, input.confirmation_ref);
+        return {
+            schema_version: "long-task-external-confirmation-rotate-v1",
+            confirmation_ref: input.confirmation_ref,
+            challenge: challenge.challenge,
+            rotated_at: challenge.rotated_at,
+        };
+    });
+}
+export async function evaluateExternalConfirmations(compiled, repository, workdir, manifest, candidate, semanticManifestInput) {
+    const semanticManifest = semanticManifestInput ??
+        (await loadSemanticFactManifest(repository, compiled.task.source_paths))
+            .manifest;
+    const context = {
+        repository,
+        workdir,
+        compiled,
+        manifest,
+        candidate,
+        candidate_dirty: [],
+        semantic_manifest: semanticManifest,
+    };
+    const results = [];
+    for (const confirmation of [
+        ...compiled.global.acceptance.external_confirmations,
+    ].sort((left, right) => left.key.localeCompare(right.key))) {
+        const stored = await readStoredExternalConfirmationRecord(repository, workdir, confirmation.key);
+        if (stored.error) {
+            results.push(await emptyExternalConfirmationEvaluation(context, confirmation, "invalid", [`record_invalid:${stored.error}`]));
+            continue;
+        }
+        if (!stored.record) {
+            const exactRows = allEffectiveExternalRows(compiled, confirmation.key);
+            results.push(exactRows.length || !confirmation.blocks_target
+                ? await emptyExternalConfirmationEvaluation(context, confirmation, "pending", [])
+                : await emptyExternalConfirmationEvaluation(context, confirmation, "invalid", ["blocking_confirmation_has_no_exact_obligations"]));
+            continue;
+        }
+        results.push(await evaluateExternalConfirmationRecord(context, confirmation, stored.record));
+    }
+    return results;
+}
+export const externalConfirmationRecordIntegrity = {
+    hash_v1: externalConfirmationRecordHash,
+    hash_v2: externalConfirmationRecordV2Hash,
+};

package/dist/lib/long-task-external-confirmation-preparation.d.ts

@@ -0,0 +1,4 @@
+import type { ExternalAuthorityContextV1 } from "./long-task-external-confirmation-context.js";
+import type { ExternalConfirmationCandidateV1, ExternalConfirmationPreparationConfirmationV1, ExternalConfirmationPreparationSessionV1 } from "./long-task-external-confirmation-types.js";
+export declare function externalFulfillableConfirmations(context: ExternalAuthorityContextV1, confirmationRef?: string): Promise<ExternalConfirmationPreparationConfirmationV1[]>;
+export declare function groupPreparationSessions(confirmations: ExternalConfirmationPreparationConfirmationV1[], candidate: ExternalConfirmationCandidateV1): ExternalConfirmationPreparationSessionV1[];

package/dist/lib/long-task-external-confirmation-preparation.js

@@ -0,0 +1,100 @@
+import { compiledExternalConfirmationIdentityAssurance, externalConfirmationActor, } from "./long-task-external-confirmation-attestation.js";
+import { readOrCreateExternalConfirmationChallenge } from "./long-task-external-confirmation-challenge.js";
+import { expectedForExternalObligation } from "./long-task-external-confirmation-expected.js";
+import { allEffectiveExternalRows, deriveRelevantExternalInputIdentity, requiredConfirmation, } from "./long-task-external-confirmation-identity.js";
+import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
+export async function externalFulfillableConfirmations(context, confirmationRef) {
+    if (confirmationRef)
+        requiredConfirmation(context.compiled, confirmationRef);
+    const declarations = context.compiled.global.acceptance.external_confirmations.filter((confirmation) => (!confirmationRef || confirmation.key === confirmationRef) &&
+        allEffectiveExternalRows(context.compiled, confirmation.key).length > 0);
+    const selected = (await Promise.all(declarations.map((confirmation) => prepareConfirmation(context, confirmation)))).sort((left, right) => left.confirmation_ref.localeCompare(right.confirmation_ref));
+    if (confirmationRef && !selected.length)
+        throw new Error(`external_confirmation_not_fulfillable:${confirmationRef}`);
+    return selected;
+}
+export function groupPreparationSessions(confirmations, candidate) {
+    const groups = new Map();
+    for (const confirmation of confirmations) {
+        const rows = groups.get(confirmation.session_group) ?? [];
+        rows.push(confirmation);
+        groups.set(confirmation.session_group, rows);
+    }
+    return [...groups.entries()]
+        .map(([sessionGroup, rows]) => {
+        const first = rows[0];
+        return {
+            session_group: sessionGroup,
+            suggested_session_id: `external-${sessionGroup.slice(0, 16)}-${candidate.snapshot_sha256.slice(0, 12)}`,
+            actor: first.actor,
+            identity_assurance: first.identity_assurance,
+            target_ref: first.target_ref,
+            environment_identity: first.environment_identity,
+            scenario: first.scenario,
+            evidence_requirements: first.evidence_requirements,
+            confirmation_refs: rows.map((row) => row.confirmation_ref).sort(),
+            obligations: rows
+                .flatMap((row) => row.obligations)
+                .sort((left, right) => left.obligation_ref.localeCompare(right.obligation_ref)),
+        };
+    })
+        .sort((left, right) => left.session_group.localeCompare(right.session_group));
+}
+async function prepareConfirmation(context, confirmation) {
+    if (!confirmation.actor ||
+        !confirmation.target_ref ||
+        !confirmation.environment_identity ||
+        !confirmation.scenario ||
+        !confirmation.evidence_requirements?.length ||
+        !confirmation.obligations?.length)
+        throw new Error(`external_confirmation_declaration_incomplete:${confirmation.key}`);
+    const actor = externalConfirmationActor(confirmation);
+    const identityAssurance = compiledExternalConfirmationIdentityAssurance(context.compiled, confirmation.key);
+    if (!actor || !identityAssurance || identityAssurance.scheme !== "ed25519")
+        throw new Error(`external_confirmation_authenticated_actor_required:${confirmation.key}`);
+    const challenge = await readOrCreateExternalConfirmationChallenge(context, confirmation.key);
+    const relevant = deriveRelevantExternalInputIdentity(context.compiled, confirmation.key, context.manifest);
+    const obligations = allEffectiveExternalRows(context.compiled, confirmation.key)
+        .map((row) => prepareObligation(context, confirmation, row))
+        .sort((left, right) => left.obligation_ref.localeCompare(right.obligation_ref));
+    const groups = [...new Set(obligations.map((row) => row.session_group))];
+    if (groups.length !== 1 || !groups[0])
+        throw new Error(`external_confirmation_session_group_invalid:${confirmation.key}`);
+    const prepared = {
+        confirmation_ref: confirmation.key,
+        description: confirmation.description,
+        owner: confirmation.owner,
+        actor,
+        identity_assurance: identityAssurance,
+        target_ref: confirmation.target_ref,
+        environment_identity: confirmation.environment_identity,
+        scenario: confirmation.scenario,
+        evidence_requirements: confirmation.evidence_requirements,
+        session_group: groups[0],
+        relevant_input_identity: relevant.identity,
+        relevant_input_mode: relevant.mode,
+        relevant_input_paths: relevant.paths,
+        challenge: challenge.challenge,
+        obligations,
+    };
+    return {
+        ...prepared,
+        signable_canonical_digest: sha256Hex(canonicalValueJson({
+            schema_version: "long-task-external-confirmation-signing-context-v2",
+            compiled_identity: context.compiled.compiled_identity,
+            authority_revision: context.compiled.authority_revision,
+            candidate: context.candidate,
+            ...prepared,
+        })),
+    };
+}
+function prepareObligation(context, confirmation, row) {
+    const declaration = confirmation.obligations.find((obligation) => obligation.key === row.obligation_ref);
+    if (!declaration)
+        throw new Error(`external_confirmation_obligation_declaration_missing:${confirmation.key}:${row.obligation_ref}`);
+    return {
+        ...row,
+        result_kind: declaration.result_kind,
+        expected: expectedForExternalObligation(context.compiled, context.semantic_manifest, row, declaration.expected_authority_ref),
+    };
+}

package/dist/lib/long-task-external-confirmation-shape.d.ts

@@ -0,0 +1,8 @@
+import type { ExternalConfirmationRecord, ExternalConfirmationRecordV1, ExternalConfirmationRecordV2 } from "./long-task-external-confirmation-types.js";
+export declare function parseExternalConfirmationRecord(value: unknown): ExternalConfirmationRecord;
+export declare function parseExternalConfirmationRecordV1(value: unknown): ExternalConfirmationRecordV1;
+export declare function parseExternalConfirmationRecordV2(value: unknown): ExternalConfirmationRecordV2;
+export declare function externalConfirmationRecordHash(record: Omit<ExternalConfirmationRecordV1, "record_sha256"> | ExternalConfirmationRecordV1): string;
+export declare function signExternalConfirmationRecordV1(unsigned: Omit<ExternalConfirmationRecordV1, "record_sha256">): ExternalConfirmationRecordV1;
+export declare function externalConfirmationRecordV2Hash(record: Omit<ExternalConfirmationRecordV2, "record_sha256"> | ExternalConfirmationRecordV2): string;
+export declare function externalConfirmationV2SignablePayload(record: ExternalConfirmationRecordV2): string;