rea-agents 6.2.0 → 6.4.0

package/dist/domain/managed/managedInspectionEvidence.js

@@ -1,4 +1,8 @@
 import { parseEvidence } from "../evidence.js";
+/** Build-local metadata tokens join only under a known, matching module MVID. */
+export const managedTokenScopesMatch = (leftMvid, rightMvid) => leftMvid !== null &&
+    rightMvid !== null &&
+    leftMvid.toLowerCase() === rightMvid.toLowerCase();
 /**
  * Parse managed inspection Evidence and bind its artifact to any available subject.
  * A null subject remains valid and means there is no digest to cross-check.
@@ -12,5 +16,14 @@ export const parseManagedInspectionEvidence = (rawEvidence, operation, schema) =
     const subjectSha256 = evidence.subject?.digest.sha256;
     if (subjectSha256 !== undefined && artifactSha256 !== subjectSha256)
         throw new TypeError(`Managed Evidence ${operation} (${evidence.evidence_id}) subject SHA-256 ${subjectSha256} does not match normalized artifact SHA-256 ${artifactSha256}`);
+    const scope = result.identity_scope;
+    if (scope !== undefined && scope.requires_artifact_sha256 !== artifactSha256)
+        throw new TypeError(`Managed Evidence ${operation} (${evidence.evidence_id}) token scope SHA-256 ${scope.requires_artifact_sha256} does not match normalized artifact SHA-256 ${artifactSha256}`);
+    if (scope?.requires_mvid !== undefined &&
+        scope.requires_mvid !== null &&
+        result.module?.mvid !== undefined &&
+        result.module.mvid !== null &&
+        scope.requires_mvid.toLowerCase() !== result.module.mvid.toLowerCase())
+        throw new TypeError(`Managed Evidence ${operation} (${evidence.evidence_id}) token scope MVID ${scope.requires_mvid} does not match module MVID ${result.module.mvid}`);
     return { evidence, result };
 };

package/dist/domain/managed/managedMemberComparisonMatch.js

@@ -11,21 +11,21 @@ export const sha256 = (value) => {
 const keyMethod = (item) => ({
     item,
     exactKey: item.body.status === "present" && item.body.normalized_il_sha256 !== null
-        ? stableKey([
+        ? sha256([
             "method-exact",
             item.signature.raw_sha256,
             item.body.normalized_il_sha256,
         ])
         : null,
     // The raw blob is the exact signature; decoding only feeds shape keys.
-    signatureKey: stableKey([
+    signatureKey: sha256([
         "method-signature",
         item.declaring_type,
         item.name,
         item.signature.raw_sha256,
     ]),
     structuralKey: item.signature.parse_status === "decoded" && item.body.status === "present"
-        ? stableKey([
+        ? sha256([
             "method-structural",
             item.signature.kind,
             item.signature.calling_convention,
@@ -56,24 +56,23 @@ const keyMethod = (item) => ({
 const keyField = (item) => ({
     item,
     exactKey: item.signature.parse_status === "decoded"
-        ? stableKey(["field-exact", item.signature.raw_sha256])
+        ? sha256(["field-exact", item.signature.raw_sha256])
         : null,
     // Only an undecoded field reaches this round: a decoded field with the
     // same raw signature already met its counterpart in the exact round.
-    signatureKey: stableKey([
+    signatureKey: sha256([
         "field-signature",
         item.declaring_type,
         item.name,
         item.signature.raw_sha256,
     ]),
-    structuralKey: stableKey([
+    structuralKey: sha256([
         "field-structural",
         item.signature.kind,
         item.signature.field_type,
         item.flags,
     ]),
 });
-const stableKey = (value) => sha256(value);
 const matchMethods = (left, right) => matchByKeys({
     left,
     right,