project-tiny-context-harness 0.8.17 → 0.12.0

package/dist/lib/long-task-json-pointer-observation.js

@@ -1,184 +0,0 @@
-import path from "node:path";
-import { canonicalValueJson, parseStrictYaml, sha256Hex, } from "./strict-codec.js";
-export const JSON_POINTER_EXACT_CAPABILITY = "json-pointer-exact-v1";
-export const JSON_POINTER_EXACT_ORACLE_IDENTITY = "ty-context-json-pointer-exact";
-export const JSON_POINTER_EXACT_ORACLE_VERSION = "1.0.0";
-export const JSON_POINTER_EXACT_METHODS = Object.freeze([
-    "exact_value",
-    "content",
-    "component_state",
-]);
-export const JSON_POINTER_EXACT_LIMITS = Object.freeze({
-    max_file_bytes: 1_048_576,
-    max_depth: 64,
-    max_pointer_bytes: 4_096,
-    max_pointer_segments: 128,
-    max_canonical_value_bytes: 262_144,
-    max_artifacts_per_check: 256,
-    max_total_artifact_bytes: 16_777_216,
-});
-export const JSON_POINTER_EXACT_SPEC_SHA256 = sha256Hex(canonicalValueJson({
-    capability: JSON_POINTER_EXACT_CAPABILITY,
-    oracle_identity: JSON_POINTER_EXACT_ORACLE_IDENTITY,
-    oracle_version: JSON_POINTER_EXACT_ORACLE_VERSION,
-    media_type: "application/json",
-    encoding: "utf-8",
-    locator: "rfc6901-json-pointer",
-    canonicalization: "canonical-json-v1",
-    methods: JSON_POINTER_EXACT_METHODS,
-    comparator: "exact_value",
-    mode: "exact",
-    sensitivity: "plain",
-    limits: JSON_POINTER_EXACT_LIMITS,
-}));
-export function createJsonPointerExactBudget() {
-    return { seen_artifact_paths: new Set(), total_artifact_bytes: 0 };
-}
-export function isJsonPointerExactOracle(oracle) {
-    return (oracle.trust === "named_external_tcb" &&
-        oracle.identity === JSON_POINTER_EXACT_ORACLE_IDENTITY &&
-        oracle.version === JSON_POINTER_EXACT_ORACLE_VERSION &&
-        oracle.sha256 === null);
-}
-export function extractJsonPointerExactObservationFromBytes(input) {
-    const artifactPath = normalizeObservationArtifactPath(input.artifact_path);
-    if (input.sensitivity !== "plain")
-        throw invalidObservation("observation_protected_requires_frozen_adapter");
-    if (input.bytes.byteLength > JSON_POINTER_EXACT_LIMITS.max_file_bytes)
-        throw invalidObservation("observation_artifact_size_limit");
-    accountForArtifact(input.budget, artifactPath, input.bytes.byteLength);
-    const locator = validateJsonPointerExactLocator(input.locator);
-    const parsed = parseJsonWithoutDuplicateKeys(decodeUtf8Json(input.bytes));
-    assertJsonTree(parsed, 0);
-    const canonical = canonicalValueJson(resolveJsonPointer(parsed, locator.value));
-    const canonicalBytes = Buffer.byteLength(canonical, "utf8");
-    if (canonicalBytes > JSON_POINTER_EXACT_LIMITS.max_canonical_value_bytes)
-        throw invalidObservation("observation_canonical_value_size_limit");
-    return {
-        capability: JSON_POINTER_EXACT_CAPABILITY,
-        artifact_path: artifactPath,
-        artifact_sha256: sha256Hex(input.bytes),
-        locator,
-        value_sha256: sha256Hex(canonical),
-        canonical_value_bytes: canonicalBytes,
-        sensitivity: "plain",
-    };
-}
-export function validateJsonPointerExactLocator(locator) {
-    if (locator.kind !== "json_pointer" ||
-        typeof locator.value !== "string" ||
-        locator.value.startsWith("#") ||
-        (locator.value !== "" && !locator.value.startsWith("/")) ||
-        Buffer.byteLength(locator.value, "utf8") >
-            JSON_POINTER_EXACT_LIMITS.max_pointer_bytes)
-        throw invalidObservation("observation_locator_not_admitted");
-    const encoded = locator.value === "" ? [] : locator.value.slice(1).split("/");
-    if (encoded.length > JSON_POINTER_EXACT_LIMITS.max_pointer_segments)
-        throw invalidObservation("observation_locator_segment_limit");
-    for (const token of encoded)
-        if (/~(?:[^01]|$)/u.test(token))
-            throw invalidObservation("observation_locator_not_admitted");
-    return { kind: "json_pointer", value: locator.value };
-}
-export function normalizeObservationArtifactPath(value) {
-    if (!value ||
-        value.includes("\\") ||
-        value.includes("\0") ||
-        path.posix.isAbsolute(value) ||
-        /^[a-z]:/iu.test(value))
-        throw invalidObservation("observation_artifact_path_escape");
-    const segments = value.split("/");
-    if (segments.some((segment) => !segment || segment === "." || segment === ".."))
-        throw invalidObservation("observation_artifact_path_escape");
-    return segments.join("/");
-}
-export function invalidObservation(code) {
-    return new Error(code);
-}
-export function observationErrorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-export function resolveJsonPointer(root, pointer) {
-    let current = root;
-    if (pointer === "")
-        return current;
-    for (const encoded of pointer.slice(1).split("/")) {
-        const token = encoded.replace(/~1/gu, "/").replace(/~0/gu, "~");
-        if (Array.isArray(current)) {
-            if (!/^(?:0|[1-9]\d*)$/u.test(token))
-                throw invalidObservation("observation_locator_array_index_invalid");
-            const index = Number(token);
-            if (!Number.isSafeInteger(index) || index >= current.length)
-                throw invalidObservation("observation_locator_not_found");
-            current = current[index];
-            continue;
-        }
-        if (!current ||
-            typeof current !== "object" ||
-            !Object.hasOwn(current, token))
-            throw invalidObservation("observation_locator_not_found");
-        current = current[token];
-    }
-    return current;
-}
-export function parseJsonWithoutDuplicateKeys(content) {
-    let parsed;
-    try {
-        parsed = JSON.parse(content);
-    }
-    catch {
-        throw invalidObservation("observation_json_invalid");
-    }
-    try {
-        const strict = parseStrictYaml(content);
-        if (canonicalValueJson(strict) !== canonicalValueJson(parsed))
-            throw invalidObservation("observation_json_canonicalization_mismatch");
-    }
-    catch (error) {
-        if (observationErrorMessage(error).includes("unique"))
-            throw invalidObservation("observation_json_duplicate_key");
-        if (observationErrorMessage(error).startsWith("observation_"))
-            throw error;
-        throw invalidObservation("observation_json_invalid");
-    }
-    return parsed;
-}
-export function decodeUtf8Json(bytes) {
-    if (bytes.byteLength >= 3 &&
-        bytes[0] === 0xef &&
-        bytes[1] === 0xbb &&
-        bytes[2] === 0xbf)
-        throw invalidObservation("observation_json_utf8_invalid");
-    try {
-        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-    }
-    catch {
-        throw invalidObservation("observation_json_utf8_invalid");
-    }
-}
-export function assertJsonTree(value, depth) {
-    if (depth > JSON_POINTER_EXACT_LIMITS.max_depth)
-        throw invalidObservation("observation_json_depth_limit");
-    if (typeof value === "number" && !Number.isFinite(value))
-        throw invalidObservation("observation_json_number_invalid");
-    if (Array.isArray(value)) {
-        for (const entry of value)
-            assertJsonTree(entry, depth + 1);
-        return;
-    }
-    if (value && typeof value === "object")
-        for (const entry of Object.values(value))
-            assertJsonTree(entry, depth + 1);
-}
-function accountForArtifact(budget, artifactPath, bytes) {
-    if (!budget || budget.seen_artifact_paths.has(artifactPath))
-        return;
-    if (budget.seen_artifact_paths.size >=
-        JSON_POINTER_EXACT_LIMITS.max_artifacts_per_check)
-        throw invalidObservation("observation_artifact_count_limit");
-    if (budget.total_artifact_bytes + bytes >
-        JSON_POINTER_EXACT_LIMITS.max_total_artifact_bytes)
-        throw invalidObservation("observation_artifact_total_size_limit");
-    budget.seen_artifact_paths.add(artifactPath);
-    budget.total_artifact_bytes += bytes;
-}

package/dist/lib/long-task-observation-artifact.d.ts

@@ -1,8 +0,0 @@
-import { type JsonPointerExactBudget, type JsonPointerExactLocator, type JsonPointerExactObservation } from "./long-task-json-pointer-observation.js";
-export declare function extractJsonPointerExactObservation(input: {
-    root: string;
-    artifact_path: string;
-    locator: JsonPointerExactLocator;
-    sensitivity: string;
-    budget?: JsonPointerExactBudget;
-}): Promise<JsonPointerExactObservation>;

package/dist/lib/long-task-observation-artifact.js

@@ -1,58 +0,0 @@
-import { lstat, open, realpath } from "node:fs/promises";
-import path from "node:path";
-import { JSON_POINTER_EXACT_LIMITS, extractJsonPointerExactObservationFromBytes, invalidObservation, normalizeObservationArtifactPath, } from "./long-task-json-pointer-observation.js";
-export async function extractJsonPointerExactObservation(input) {
-    const artifactPath = normalizeObservationArtifactPath(input.artifact_path);
-    const root = path.resolve(input.root);
-    const resolved = path.resolve(root, ...artifactPath.split("/"));
-    assertContained(root, resolved);
-    await rejectSymbolicPath(root, artifactPath);
-    const [rootReal, fileReal] = await Promise.all([
-        realpath(root),
-        realpath(resolved),
-    ]);
-    assertContained(rootReal, fileReal);
-    const before = await lstat(resolved);
-    if (!before.isFile())
-        throw invalidObservation("observation_artifact_not_file");
-    if (before.size > JSON_POINTER_EXACT_LIMITS.max_file_bytes)
-        throw invalidObservation("observation_artifact_size_limit");
-    const handle = await open(resolved, "r");
-    try {
-        const opened = await handle.stat();
-        assertSameFile(before, opened);
-        const bytes = await handle.readFile();
-        const after = await handle.stat();
-        assertSameFile(opened, after);
-        return extractJsonPointerExactObservationFromBytes({
-            artifact_path: artifactPath,
-            bytes,
-            locator: input.locator,
-            sensitivity: input.sensitivity,
-            budget: input.budget,
-        });
-    }
-    finally {
-        await handle.close();
-    }
-}
-function assertContained(root, target) {
-    const relative = path.relative(root, target);
-    if (!relative || relative.startsWith("..") || path.isAbsolute(relative))
-        throw invalidObservation("observation_artifact_path_escape");
-}
-async function rejectSymbolicPath(root, relative) {
-    let current = root;
-    for (const segment of relative.split("/")) {
-        current = path.join(current, segment);
-        const entry = await lstat(current);
-        if (entry.isSymbolicLink())
-            throw invalidObservation("observation_artifact_symlink");
-    }
-}
-function assertSameFile(before, after) {
-    if (before.dev !== after.dev ||
-        before.ino !== after.ino ||
-        before.size !== after.size)
-        throw invalidObservation("observation_artifact_changed_during_read");
-}

package/dist/lib/long-task-observation-authority.d.ts

@@ -1,17 +0,0 @@
-import type { CompiledDesignTargetV2, CompiledObservationAuthorityV2, DeliveryCheckV2, ExecutionTargetV2, FrozenRunnerV2, SemanticFactExpectationV2, SourceBackedExecutionTargetV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
-import type { ScopedDeliveryBindingV2 } from "./long-task-scoped-binding.js";
-interface CompileObservationAuthorityPlanInput {
-    check: DeliveryCheckV2;
-    outcome_key: string | null;
-    runner: FrozenRunnerV2;
-    execution_target: ExecutionTargetV2;
-    design_targets: CompiledDesignTargetV2[];
-    semantic_fact_expectations: SemanticFactExpectationV2[];
-    production_bindings: ScopedDeliveryBindingV2[];
-    production_owner_paths: string[];
-    source_backed_execution_target: SourceBackedExecutionTargetV2 | null;
-    workspace_manifest: WorkspaceManifestV2;
-    protected_authority_paths?: readonly string[];
-}
-export declare function compileObservationAuthorityPlan(input: CompileObservationAuthorityPlanInput): CompiledObservationAuthorityV2[];
-export {};

package/dist/lib/long-task-observation-authority.js

@@ -1,348 +0,0 @@
-import { JSON_POINTER_EXACT_METHODS, isJsonPointerExactOracle, } from "./long-task-json-pointer-observation.js";
-import { classifyMachineObservationCarrierRoleConflict } from "./long-task-admitted-observation.js";
-import { canonicalValueJson, sha256Hex } from "./strict-codec.js";
-import { classifyRepositoryPatternOverlap, normalizeRepositoryFile, } from "./long-task-paths.js";
-const PROCESS_DERIVED_CAPABILITIES = new Set([
-    "presence",
-    "target_runtime",
-]);
-const PROCESS_CAPABILITIES_REQUIRING_A_SEPARATE_PACKAGE_DERIVATION = new Set([
-    "interaction_trace",
-    "state_delta",
-    "design_conformance",
-]);
-const STATIC_DERIVED_CAPABILITIES = new Set(["presence"]);
-export function compileObservationAuthorityPlan(input) {
-    const assertions = new Map([
-        ...input.check.positive_assertions,
-        ...input.check.negative_assertions,
-    ].map((assertion) => [assertion.key, assertion]));
-    const candidates = [];
-    const factBoundAssertions = new Set();
-    for (const expectation of input.semantic_fact_expectations) {
-        if (expectation.observer_refs.length)
-            fail("semantic_fact_machine_observer_not_admitted", `${expectation.proof_ref}:observer_results_package_channel_unavailable:${expectation.observer_refs.join(",")}`);
-        const assertion = requiredAssertion(assertions, expectation.assertion_ref, `semantic_fact_machine_observer_not_admitted:${expectation.proof_ref}`);
-        factBoundAssertions.add(assertion.key);
-        candidates.push({
-            obligation_ref: expectation.proof_ref,
-            observation_identity: expectation.fact_ref,
-            fact_ref: expectation.fact_ref,
-            assertion,
-            target_ref: input.check.execution_target.target_ref,
-            method: expectation.method,
-            expected_value_sha256: expectation.expected.sha256,
-            actual_projection: "raw_exact",
-            comparison: {
-                comparator: expectation.comparison.comparator,
-                mode: expectation.comparison.mode,
-                parameters_sha256: expectation.comparison.parameters.sha256,
-                tolerance_sha256: expectation.comparison.tolerance?.sha256 ?? null,
-                mask_sha256: expectation.comparison.mask?.sha256 ?? null,
-            },
-            sensitivity: expectation.observation_sensitivity,
-            oracle: expectation.oracle,
-            diagnostic_scope: "semantic_fact",
-        });
-    }
-    for (const target of input.design_targets) {
-        if (target.target_ref !== input.check.execution_target.target_ref)
-            fail("machine_observer_not_admitted", `${target.key}:target_mismatch:${target.target_ref}:${input.check.execution_target.target_ref}`);
-        for (const binding of target.verification_method_bindings)
-            for (const artifact of binding.evidence_artifacts)
-                for (const expectation of artifact.fact_expectations) {
-                    const assertion = requiredAssertion(assertions, binding.assertion_ref, `machine_observer_not_admitted:${target.key}:${binding.method}`);
-                    factBoundAssertions.add(assertion.key);
-                    candidates.push({
-                        obligation_ref: designGroundObligationRef(target.key, binding.method, artifact.condition_key, expectation.fact_ref),
-                        observation_identity: expectation.fact_ref,
-                        fact_ref: expectation.fact_ref,
-                        assertion,
-                        target_ref: target.target_ref,
-                        method: binding.method,
-                        expected_value_sha256: expectation.expected.sha256,
-                        actual_projection: "raw_exact",
-                        comparison: {
-                            comparator: expectation.comparison.comparator,
-                            mode: expectation.comparison.mode,
-                            parameters_sha256: expectation.comparison.parameters.sha256,
-                            tolerance_sha256: expectation.comparison.tolerance?.sha256 ?? null,
-                            mask_sha256: expectation.comparison.mask?.sha256 ?? null,
-                        },
-                        sensitivity: expectation.observation_sensitivity,
-                        oracle: expectation.oracle,
-                        diagnostic_scope: "design_fact",
-                    });
-                }
-        for (const binding of target.symbolic_method_bindings ?? [])
-            for (const expectation of binding.rule_expectations) {
-                const assertion = requiredAssertion(assertions, binding.assertion_ref, `machine_observer_not_admitted:${target.key}:${binding.method}`);
-                factBoundAssertions.add(assertion.key);
-                if (expectation.proof_surface !== input.check.proof_surface)
-                    fail("unsupported_observer_requires_external_confirmation", `${target.key}:${expectation.obligation_ref}:proof_surface_mismatch`);
-                candidates.push({
-                    obligation_ref: expectation.obligation_ref,
-                    observation_identity: expectation.obligation_ref,
-                    fact_ref: expectation.fact_rule_ref,
-                    assertion,
-                    target_ref: target.target_ref,
-                    method: binding.method,
-                    expected_value_sha256: expectation.expected.sha256,
-                    actual_projection: "raw_exact",
-                    comparison: {
-                        comparator: expectation.comparison.comparator,
-                        mode: expectation.comparison.mode,
-                        parameters_sha256: expectation.comparison.parameters.sha256,
-                        tolerance_sha256: expectation.comparison.tolerance?.sha256 ?? null,
-                        mask_sha256: expectation.comparison.mask?.sha256 ?? null,
-                    },
-                    sensitivity: expectation.observation_sensitivity,
-                    oracle: expectation.oracle,
-                    diagnostic_scope: "design_fact",
-                });
-            }
-    }
-    for (const assertion of assertions.values()) {
-        if (factBoundAssertions.has(assertion.key))
-            continue;
-        const expected = exactAssertionExpected(assertion);
-        const obligationRef = assertionObligationRef(input.outcome_key, input.check.key, assertion.key);
-        candidates.push({
-            obligation_ref: obligationRef,
-            observation_identity: obligationRef,
-            fact_ref: null,
-            assertion,
-            target_ref: input.check.execution_target.target_ref,
-            method: "exact_value",
-            expected_value_sha256: sha256Hex(canonicalValueJson(expected)),
-            actual_projection: assertionActualProjection(assertion),
-            comparison: {
-                comparator: "exact_value",
-                mode: "exact",
-                parameters_sha256: sha256Hex(canonicalValueJson({ comparator: "exact_value" })),
-                tolerance_sha256: null,
-                mask_sha256: null,
-            },
-            sensitivity: "plain",
-            diagnostic_scope: "assertion",
-        });
-    }
-    const rows = candidates.map((candidate) => compileCandidate(input, candidate));
-    assertUniqueRows(rows);
-    return rows.sort((left, right) => canonicalValueJson(left).localeCompare(canonicalValueJson(right)));
-}
-function compileCandidate(input, candidate) {
-    const unimplementedDerivedCapability = candidate.assertion.evidence_capabilities.find((capability) => PROCESS_CAPABILITIES_REQUIRING_A_SEPARATE_PACKAGE_DERIVATION.has(capability));
-    if (unimplementedDerivedCapability)
-        fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:${unimplementedDerivedCapability}:package_derivation_required`);
-    if (candidate.oracle && !isJsonPointerExactOracle(candidate.oracle))
-        fail("custom_oracle_machine_completion_forbidden", `${candidate.diagnostic_scope}:${candidate.obligation_ref}:${candidate.oracle.identity ?? "unknown"}`);
-    if (!JSON_POINTER_EXACT_METHODS.includes(candidate.method) ||
-        candidate.comparison.comparator !== "exact_value" ||
-        candidate.comparison.mode !== "exact" ||
-        candidate.comparison.tolerance_sha256 !== null ||
-        candidate.comparison.mask_sha256 !== null ||
-        candidate.sensitivity !== "plain")
-        fail(candidate.diagnostic_scope === "semantic_fact"
-            ? "semantic_fact_machine_observer_not_admitted"
-            : "unsupported_observer_requires_external_confirmation", `${candidate.diagnostic_scope}:${candidate.obligation_ref}:plain_exact_json_required`);
-    const authority = selectAuthority(input, candidate);
-    const carrierRefs = productionCarrierRefs(input);
-    if (authority === "package_static_json_exact") {
-        if (!carrierRefs.length)
-            fail("machine_observer_not_admitted", `${candidate.obligation_ref}:production_binding_carrier_required`);
-        if (carrierRefs.length !== 1)
-            fail("machine_observer_not_admitted", `${candidate.obligation_ref}:static_production_binding_ambiguous`);
-        const staticPaths = carrierRefs[0].carrier_paths;
-        if (staticPaths.length !== 1 || !isExactRepositoryFile(staticPaths[0]))
-            fail("machine_observer_not_admitted", `${candidate.obligation_ref}:static_production_carrier_exact_path_required`);
-    }
-    if (authority === "package_static_json_exact")
-        for (const carrierPath of carrierRefs.flatMap((carrier) => carrier.carrier_paths)) {
-            const carrierRoleIssue = staticObservationCarrierRoleConflict(input, carrierPath);
-            if (carrierRoleIssue)
-                fail("machine_observer_not_admitted", `${candidate.obligation_ref}:${carrierRoleIssue}`);
-        }
-    const comparison = candidate.comparison;
-    const expectedIdentity = sha256Hex(canonicalValueJson({
-        obligation_ref: candidate.obligation_ref,
-        fact_ref: candidate.fact_ref,
-        method: candidate.method,
-        expected_value_sha256: candidate.expected_value_sha256,
-        comparison,
-        actual_projection: candidate.actual_projection,
-        carrier_refs: carrierRefs,
-    }));
-    return {
-        obligation_ref: candidate.obligation_ref,
-        fact_ref: candidate.fact_ref,
-        assertion_ref: candidate.assertion.key,
-        claim_refs: [...candidate.assertion.claims].sort(),
-        target_ref: candidate.target_ref,
-        proof_surface: input.check.proof_surface,
-        method: candidate.method,
-        evidence_capabilities: [
-            ...candidate.assertion.evidence_capabilities,
-        ].sort(),
-        authority,
-        expected_identity: expectedIdentity,
-        expected_value_sha256: candidate.expected_value_sha256,
-        actual_projection: candidate.actual_projection,
-        observation_identity: candidate.observation_identity,
-        comparison,
-        locator_policy: {
-            kind: "fixed_json_pointer",
-            value: observationPointer(candidate.observation_identity),
-        },
-        carrier_refs: carrierRefs,
-        runtime_requirements: runtimeRequirements(input),
-    };
-}
-function selectAuthority(input, candidate) {
-    const target = input.execution_target;
-    if (target.role !== "product")
-        fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:product_target_required`);
-    if (input.check.proof_surface === "implementation_structure") {
-        if (!input.check.input_paths.length)
-            fail("machine_observer_not_admitted", `${candidate.obligation_ref}:static_carrier_required`);
-        if (!capabilitiesAdmitted(candidate.assertion.evidence_capabilities, admittedCapabilities(candidate, STATIC_DERIVED_CAPABILITIES)))
-            fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:static_capability_not_admitted`);
-        return "package_static_json_exact";
-    }
-    if (target.runtime_family !== "process" ||
-        input.check.proof_surface === "ui_browser" ||
-        input.check.proof_surface === "population_coverage")
-        fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:${target.runtime_family}:${input.check.proof_surface}`);
-    if (input.check.runner.type !== "project_binary" ||
-        input.check.execution_target.entrypoint !== "root" ||
-        input.runner.resolved_target !== target.root_entrypoint)
-        fail("process_observer_direct_root_required", `${candidate.obligation_ref}:${input.runner.resolved_target}:${target.root_entrypoint}`);
-    if (!target.root_argv)
-        fail("process_observer_root_invocation_required", candidate.obligation_ref);
-    if (!sameStringArray(input.check.runner.argv, target.root_argv))
-        fail("process_observer_root_argv_mismatch", `${candidate.obligation_ref}:${canonicalValueJson(input.check.runner.argv)}:${canonicalValueJson(target.root_argv)}`);
-    if (!capabilitiesAdmitted(candidate.assertion.evidence_capabilities, admittedCapabilities(candidate, PROCESS_DERIVED_CAPABILITIES)))
-        fail("unsupported_observer_requires_external_confirmation", `${candidate.obligation_ref}:process_capability_not_admitted`);
-    return "package_process_json_exact";
-}
-function runtimeRequirements(input) {
-    return {
-        runtime_family: input.execution_target.runtime_family,
-        target_role: input.execution_target.role,
-        entrypoint: input.check.execution_target.entrypoint,
-        runner_type: input.check.runner.type,
-        resolved_runner_target: input.runner.resolved_target,
-        declared_root_entrypoint: input.execution_target.root_entrypoint,
-        resolved_runner_argv: [...input.runner.argv],
-        declared_root_argv: input.execution_target.root_argv
-            ? [...input.execution_target.root_argv]
-            : null,
-        effect: input.check.runner.effect,
-        direct_root_match: input.check.runner.type === "project_binary" &&
-            input.check.execution_target.entrypoint === "root" &&
-            input.runner.resolved_target === input.execution_target.root_entrypoint &&
-            input.execution_target.root_argv !== undefined &&
-            sameStringArray(input.check.runner.argv, input.execution_target.root_argv),
-    };
-}
-function assertionActualProjection(assertion) {
-    if (assertion.operator === "equals")
-        return "raw_exact";
-    if (assertion.operator === "exists")
-        return "presence_boolean";
-    if (assertion.operator === "truthy")
-        return "truthy_boolean";
-    if (assertion.operator === "falsy")
-        return "falsy_boolean";
-    fail("machine_observer_not_admitted", `${assertion.key}:exact_equals_or_host_boolean_required`);
-}
-function staticObservationCarrierRoleConflict(input, carrierPath) {
-    const expectedAuthorityPatterns = [
-        ...Object.keys(input.runner.frozen_files),
-        ...(input.protected_authority_paths ?? []),
-    ];
-    const evidencePatterns = [
-        ...input.check.expected_output_paths,
-        ...input.check.artifact_globs,
-    ];
-    const conflict = classifyMachineObservationCarrierRoleConflict({
-        carrier_pattern: carrierPath,
-        expected_authority_patterns: expectedAuthorityPatterns,
-        evidence_role_patterns: evidencePatterns,
-    });
-    if (!conflict)
-        return null;
-    return `static_carrier_${conflict}_forbidden`;
-}
-function sameStringArray(left, right) {
-    return (left.length === right.length &&
-        left.every((value, index) => value === right[index]));
-}
-function capabilitiesAdmitted(capabilities, admitted) {
-    return capabilities.every((capability) => admitted.has(capability));
-}
-function admittedCapabilities(candidate, derived) {
-    const admitted = new Set(derived);
-    if (candidate.diagnostic_scope === "semantic_fact")
-        admitted.add("semantic_fact");
-    else if (candidate.diagnostic_scope === "design_fact")
-        admitted.add("design_method");
-    return admitted;
-}
-function productionCarrierRefs(input) {
-    return input.production_bindings
-        .map((scoped) => ({
-        binding_ref: scoped.binding_ref,
-        carrier_paths: scoped.binding.carrier_paths
-            .filter((carrier) => input.check.input_paths.some((inputPath) => classifyRepositoryPatternOverlap(carrier, inputPath).status ===
-            "proven_overlap"))
-            .sort(),
-    }))
-        .filter((binding) => binding.carrier_paths.length)
-        .sort((left, right) => left.binding_ref.localeCompare(right.binding_ref));
-}
-function isExactRepositoryFile(value) {
-    try {
-        normalizeRepositoryFile(value, "static_observation_carrier");
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function exactAssertionExpected(assertion) {
-    if (assertion.operator === "equals")
-        return assertion.expected;
-    if (assertion.operator === "truthy" || assertion.operator === "exists")
-        return true;
-    if (assertion.operator === "falsy")
-        return false;
-    fail("machine_observer_not_admitted", `${assertion.key}:exact_equals_or_host_boolean_required`);
-}
-function requiredAssertion(assertions, assertionRef, diagnostic) {
-    const assertion = assertions.get(assertionRef);
-    if (!assertion)
-        throw new Error(diagnostic);
-    return assertion;
-}
-function assertionObligationRef(outcomeKey, checkKey, assertionKey) {
-    return `assertion.${outcomeKey ?? "GLOBAL"}.${checkKey}.${assertionKey}`;
-}
-function designGroundObligationRef(targetKey, method, conditionKey, factRef) {
-    return `design.${targetKey}.${method}.${conditionKey}.${factRef}`;
-}
-function observationPointer(identity) {
-    return `/observations/${identity.replace(/~/gu, "~0").replace(/\//gu, "~1")}`;
-}
-function assertUniqueRows(rows) {
-    const identities = new Set();
-    for (const row of rows) {
-        const identity = `${row.assertion_ref}\0${row.obligation_ref}\0${row.method}`;
-        if (identities.has(identity))
-            fail("machine_observer_not_admitted", `duplicate:${identity}`);
-        identities.add(identity);
-    }
-}
-function fail(code, detail) {
-    throw new Error(`${code}:${detail}`);
-}

package/dist/lib/long-task-observation-ownership.d.ts

@@ -1,2 +0,0 @@
-import type { CompiledCheckV2 } from "./long-task-delivery-types.js";
-export declare function validateRawExecutionObservationOwnership(checks: CompiledCheckV2[]): void;

package/dist/lib/long-task-observation-ownership.js

@@ -1,22 +0,0 @@
-export function validateRawExecutionObservationOwnership(checks) {
-    const byExecution = new Map();
-    for (const check of checks) {
-        let observations = byExecution.get(check.raw_execution_identity);
-        if (!observations) {
-            observations = new Map();
-            byExecution.set(check.raw_execution_identity, observations);
-        }
-        for (const assertion of [
-            ...check.positive_assertions,
-            ...check.negative_assertions,
-        ]) {
-            if (!assertion.claims.length)
-                continue;
-            const owner = `${check.outcome_key ?? "GLOBAL"}.${check.key}.${assertion.key}`;
-            const previous = observations.get(assertion.observation);
-            if (previous)
-                throw new Error(`raw_execution_observation_reused:${check.raw_execution_identity}:${assertion.observation}:${previous}:${owner}`);
-            observations.set(assertion.observation, owner);
-        }
-    }
-}

package/dist/lib/long-task-outcome-parser.d.ts

@@ -1,4 +0,0 @@
-import type { DeliveryOutcomeV2 } from "./long-task-delivery-types.js";
-export declare function parseOutcome(value: unknown, label: string): DeliveryOutcomeV2;
-export declare function parseOutcomeFragment(raw: string, relative: string): DeliveryOutcomeV2[];
-export declare function safeFragmentPath(value: string, index: number): string;